Search Images Maps Play YouTube News Gmail Drive More »
Sign in
Screen reader users: click this link for accessible mode. Accessible mode has the same essential features but works better with your reader.

Patents

  1. Advanced Patent Search
Publication numberUS5319705 A
Publication typeGrant
Application numberUS 07/964,324
Publication date7 Jun 1994
Filing date21 Oct 1992
Priority date21 Oct 1992
Fee statusPaid
Publication number07964324, 964324, US 5319705 A, US 5319705A, US-A-5319705, US5319705 A, US5319705A
InventorsAlphonse M. Bracco, Bernard J. Halter, Donald B. Johnson, An V. Le, Stephen M. Matyas, Rostislaw Prymak, deceased, James D. Randall, John D. Wilkins
Original AssigneeInternational Business Machines Corporation
Export CitationBiBTeX, EndNote, RefMan
External Links: USPTO, USPTO Assignment, Espacenet
Method and system for multimedia access control enablement
US 5319705 A
Abstract
A method and system are disclosed for securely distributing a plurality of software files from a software distribution processor to a user processor, while selectively enabling the user processor to only use a subset of a lesser plurality of the software files. This is achieved by employing a customer key which includes a clear customer number and a derived portion derived from the customer number. The customer key is transformed into a second customer key which serves as a key expression for encrypting a file encryption key specifically intended for a respective one of the plurality of files. A plurality of software files can be stored together, for example on a CD-ROM, with each file encrypted under a corresponding file encryption key. The CD-ROM can be distributed to many user processors. When a specific user processor needs to run one of the software files, a request will be transmitted from the user processor to the software distribution processor. In response to that request, an encrypted file encryption key specific for the requested file, will be transmitted to the user processor. This will enable the user processor to decrypt only the requested file from the CD-ROM. All other files on the CD-ROM remain in their encrypted form and cannot be decrypted and used by the file encryption key received from the software distribution processor.
Images(14)
Previous page
Next page
Claims(21)
What is claimed is:
1. A method for securely distributing a plurality of software files from a software distribution processor to a user processor, and selectively enabling the user processor to use a subset of a lesser plurality of said plurality of software files, comprising the steps of:
storing in said software distribution processor a plurality of software files including an ith software file;
storing in said software distribution processor a plurality of file encryption keys including an ith file encryption key;
encrypting in said software distribution processor said plurality of said software files, using corresponding ones of said plurality of file encryption keys, including encrypting said ith file using said ith file encryption key, producing a plurality of encrypted files which includes an ith encrypted file which is said ith file encrypted under said ith file encryption key;
transmitting from said software distribution processor to a user processor at least a portion of said plurality of encrypted files;
storing in said software distribution processor, a first customer key which includes a clear customer number and a second portion;
transforming in said software distribution center, said first customer key with a transformation function producing a second customer key;
encrypting said ith file encryption key with said second customer key, producing an encrypted ith file encryption key;
transmitting from said software distribution processor to a user processor, said first customer key;
transmitting from said software distribution processor to said user processor, said encrypted ith file encryption key;
transforming at said user processor said first customer key using said transformed function, producing said second customer key;
decrypting said ith file encryption key received at said user processor using said second customer key, recovering said ith file encryption key;
decrypting said ith encrypted file received at said user processor, using said recovered ith file encryption key, producing said ith software file;
whereby the user processor is enabled to use said ith software file.
2. The method of claim 1 which further comprises said first customer key including a customer number and an authentication code.
3. The method of claim 2 wherein said second portion of said first customer key includes an encrypted expression of said customer number.
4. The method of claim 1 wherein said second portion of said first customer key includes an encrypted expression of said customer number.
5. The method of claim 1 wherein said second portion of said first customer key includes an encrypted expression of said customer number, encrypted under a key encrypting key and a counter value.
6. The method of claim 5 wherein said encrypted expression is a 64-bit DES key, and every eighth parity bit has substituted for it a corresponding authorization bit derived from said customer number.
7. The method of claim 1 wherein said plurality of encrypted files are stored on a CD ROM storage device which is transported from said software distribution processor to said user processor.
8. The method of claim 1 wherein said plurality of encrypted files are stored in a bulk storage at said software distribution processor and are distributed to said user processor over a data communications network.
9. Said method of claim 1 wherein said second portion of said first customer key is an encrypted expression derived from said customer number and a counter value encrypted under a key encrypting key;
said counter value representing a sublicensed customer number.
10. The method of claim 1 wherein a request is transmitted from said user processor to said software distribution processor for said ith file, and in response thereto said ith file encryption key is encrypted and transmitted from said software distribution processor to said user processor.
11. A system for securely distributing a plurality of software files from a software distribution processor to a user processor, and selectively enabling the user processor to use a subset of a lesser plurality of said plurality of software files, comprising:
means for storing in said software distribution processor a plurality of software files including an ith software file;
means for storing in said software distribution processor a plurality of file encryption keys including an ith file encryption key;
means for encrypting in said software distribution processor said plurality of said software files, using corresponding ones of said plurality of file encryption keys, including encrypting said ith file using said ith file encryption key, producing a plurality of encrypted files which includes an ith encrypted file which is said ith file encrypted under said ith file encryption key;
means for transmitting from said software distribution processor to a user processor at least a portion of said plurality of encrypted files;
means for storing in said software distribution processor, a first customer key which includes a clear customer number and a second portion;
means for transforming in said software distribution center, said first customer key with a transformation function producing a second customer key;
means for encrypting said ith file encryption key with said second customer key, producing an encrypted ith file encryption key;
means for transmitting from said software distribution processor to a user processor, said first customer key;
means for transmitting from said software distribution processor to said user processor, said encrypted ith file encryption key;
means for transforming at said user processor said first customer key using said transformed function, producing said second customer key;
means for decrypting said ith file encryption key received at said user processor using said second customer key, recovering said ith file encryption key;
means for decrypting said ith encrypted file received at said user processor, using said recovered ith file encryption key, producing said ith software file;
whereby the user processor is enabled to use said ith software file.
12. The system of claim 11 which further comprises said first customer key including a customer number and an authentication code.
13. The system of claim 12 wherein said second portion of said first customer key includes an encrypted expression of said customer number.
14. The system of claim 11 wherein said second portion of said first customer key includes an encrypted expression of said customer number.
15. The system of claim 11 wherein said second portion of said first customer key includes an encrypted expression of said customer number, encrypted under a key encrypting key and a counter value.
16. The system of claim 15 wherein said encrypted expression is a 64-bit DES key, and every eighth parity bit has substituted for it a corresponding authorization bit derived from said customer number.
17. The system of claim 11 wherein said plurality of encrypted files are stored on a CD ROM storage device which is transported from said software distribution processor to said user processor.
18. The system of claim 11 wherein said plurality of encrypted files are stored in a bulk storage at said software distribution processor and are distributed to said user processor over a data communications network.
19. Said system of claim 11 wherein said second portion of said first customer key is an encrypted expression derived from said customer number and a counter value encrypted under a key encrypting key;
said counter value representing a sublicensed customer number.
20. The system of claim 11 wherein a request is transmitted from said user processor to said software distribution processor for said ith file, and in response thereto said ith file encryption key is encrypted and transmitted from said software distribution processor to said user processor.
21. A method for securely distributing a plurality of multimedia files from a multimedia distribution processor to a user processor, and selectively enabling the user processor to use a subset of a lesser plurality of said plurality of multimedia files, comprising the steps of:
storing in said multimedia distribution processor a plurality of multimedia files including an ith multimedia file;
storing in said multimedia distribution processor a plurality of file encryption keys including an ith file encryption key;
encrypting in said multimedia distribution processor said plurality of said multimedia files, using corresponding ones of said plurality of file encryption keys, including encrypting said ith file using said ith file encryption key, producing a plurality of encrypted files which includes an ith encrypted file which is said ith file encrypted under said ith file encryption key;
transmitting from said multimedia distribution processor to a user processor at least a portion of said plurality of encrypted files;
storing in said multimedia distribution processor, a first customer key which includes a clear customer number and a second portion;
transforming in said multimedia distribution center, said first customer key with a transformation function producing a second customer key;
encrypting said ith file encryption key with said second customer key, producing an encrypted ith file encryption key;
transmitting from said multimedia distribution processor to a user processor, said first customer key;
transmitting from said multimedia distribution processor to said user processor, said encrypted ith file encryption key;
transforming at said user processor said first customer key using said transformed function, producing said second customer key;
decrypting said ith file encryption key received at said user processor using said second customer key, recovering said ith file encryption key;
decrypting said ith encrypted file received at said user processor, using said recovered ith file encryption key, producing said ith multimedia file;
whereby the user processor is enabled to use said ith multimedia file.
Description
DESCRIPTION

1. Technical Field

The invention disclosed broadly relates to data processing systems and methods and more particularly relates to cryptographic systems and methods for use in data processing systems to enhance security.

2. Background Art

The following patents and patent applications are related to this invention and are incorporated herein by reference:

W. F. Ehrsam, et al., "Cryptographic Communication and File Security Using Terminals," U.S. Pat. No. 4,386,234, issued May 31, 1983, assigned to IBM Corporation and incorporated herein by reference.

W. F. Ehrsam, et al., "Cryptographic File Security For Single Domain Networks," U.S. Pat. No. 4,238,854, issued Dec. 9, 1980, assigned to IBM Corporation and incorporated herein by reference.

W. F. Ehrsam, et al., "Cryptographic File Security For Multiple Domain Networks," U.S. Pat. No. 4,203,166, issued May 13, 1980, assigned to IBM Corporation and incorporated herein by reference.

R. M. Best, "Cryptographic Decoder for Computer Programs," U.S. Pat. No. 4,433,207, issued Feb. 21, 1984.

R. M. Best, "Crypto Microprocessor that Executes Enciphered Programs," U.S. Pat. No. 4,465,901, issued Aug. 14, 1984.

Richard Johnstone., "Computer Software Security System," U.S. Pat. No. 4,120,030, issued Oct. 10, 1978.

S. M. Matyas, et al., "Code Protection Using Cryptography," U.S. Pat. No. 4,757,534, issued Jul. 12, 1988, assigned to IBM Corporation and incorporated herein by reference.

B. Brachtl, et al., "Controlled Use of Cryptographic Keys Via Generating Stations Established Control Values," U.S. Pat. No. 4,850,017, issued Jul. 18, 1989, assigned to IBM Corporation and incorporated herein by reference.

S. M. Matyas, et al., "Secure Management of Keys Using Control Vectors," U.S. Pat. No. 4,941,176, issued Jul. 10, 1990, assigned to IBM Corporation and incorporated herein by reference.

S. M. Matyas, et al., "Data Cryptography Operations Using Control Vectors," U.S. Pat. No. 4,918,728, issued Apr. 17, 1990, assigned to IBM Corporation and incorporated herein by reference.

B. Brachtl, et al., "Data Authentication Using Modification Detection Codes Based on a Public One Way Encryption Function," U.S. Pat. No. 4,908,861, issued Mar. 13, 1990, assigned to IBM Corporation and incorporated herein by reference.

A. S. Cutlip-Cohen, et al., "Data processing method to provide a generalized link from a reference point in an on-line book to an arbitrary multimedia object which can be dynamically updated", Ser. No. 07/755,709, Sep. 6, 1991, assigned to IBM Corporation and incorporated herein by reference.

A digital data processing system contains three basic elements: a processor element, a memory element, and an input/output element. The memory element contains addressable software programs and data. The processor element fetches and processes information stored in the memory element. The input/output element, under control of the processor element, communicates with the memory element, storing and retrieving information from the memory element. The input/output element itself can consist of several different types of units capable of supporting multimedia applications, including a video display, light pen, sound synthesizer, microphone, keyboard, mouse, printer, and communication adapter enabling networking communications to take place.

Generation and sales of multimedia programs and data represents a significant business opportunity for companies who sell computing equipment and for companies who sell multimedia programs and data alone. A multimedia application can consist of a multimedia handler program that supports the presentation of one or more multimedia objects, where each multimedia object may be a separate multimedia data file. Many different multimedia objects, or data files, can be linked into a single multimedia presentation, including both text and non-text objects. Non-text objects includes image objects, graphics objects, formatted data objects, font objects, voice objects, video objects, and animation objects. The multimedia handler program provides generalized links to arbitrary multimedia objects, such that the multimedia objects or data files can be updated dynamically. Such dynamic update capability simplifies the creation of a new version or edition of the multimedia presentation. The concept of a generalize link is described in IBM patent application Ser. No. 07/755,709.

Delivery of multimedia programs and data files (termed "software") can be done in several ways. The software can be bundled and sold with the hardware. It can be sold as a separately-priced package, i.e., the software is distributed on a physical medium such as a diskette or tape. It can also be distributed to each customer or user processor from a central software distribution processor via telephone lines, TV-cable, satellite or radio broadcast. More recently, software vendors have expressed an interest in distributing software by using a stamped medium such as a Compact Disk Read Only Memory (CD-ROM) or an Optical Read Only Memory (OROM). A CD-ROM can hold about 600 megabytes of data -- enough storage to hold several hundred program or data files. Such a distribution mechanism is particularly attractive, since production costs decrease significantly with higher volumes. However, when software is distributed over an open channel (e.g., telephone lines, TV-cable, satellite or radio broadcast) or via a high-density stamped medium (e.g., CD-ROM or OROM), much software is literally "put into the hands" of tens or hundreds of thousands of others who did not request the software and who have no need or wish to see the software, but who now have easy access to the software and who may be tempted to violate licence and copyright restrictions. The net expected result of such violations is a loss of revenues to software authors, publishers, and vendors. Thus, the distribution of software over an open channel or via a high-density stamped medium creates a problem quite unique and different from the more traditional problem of unauthorized copying and use of software. Although this is not the problem addressed by the present invention, it is nevertheless described herein in order to contrast the present invention with more traditional software protection methods existing in the prior art.

The prior art describes various systems for enciphering digital information to improve the security and privacy of data transmitted over communications networks. Such data may be messages transmitted during a communication session between two encryption processors or it may be data contained in a data file transmitted from a sending processor to a receiving processor. Such data files can contain executable programs as well as pure data. Examples of file encryption systems can be found in U.S. Pat. Nos. 4,386,234, 4,238,854, and 4,203,166 to Ehrsam et al. In all cases, once an encrypted file is decrypted the programs or data contained in the file must be protected using more traditional access control methods. However, such access control methods do not prevent one user from sharing decrypted programs and data with other users.

The problem of unauthorized copying and use of programs has been addressed by the prior art. U.S. Pat. No. 4,120,030 to Johnstone discloses a computer software security system wherein the data address portions of a set of computer instructions are scrambled in accordance with a predetermined cipher key before the instructions are loaded into an instruction memory. The data involved in the program is loaded into a separate data memory at the addresses specified in the original, unscrambled program. An unscrambler circuit, which operates in accordance with the cipher key, is coupled in series with the data memory address input conductors.

U.S. Pat. No. 4,168,396 to Best discloses a microprocessor for executing computer programs which have been enciphered during manufacture to deter the execution of the programs in unauthorized computers. U.S. Pat. No. 4,278,837 to Best discloses a crypto-microprocessor chip that uses a unique cipher key or tables for deciphering a program so that a program that can be executed in one chip cannot be run in any other microprocessor. U.S. Pat. No. 4,433,207 to Best discloses an integrated circuit decoder for providing micro computer users with access to several proprietary programs that have been distributed to users in cipher. The decoder chip can decipher a program when an enciphered key called a "permit code" is presented to the decoder chip.

U.S. Pat. No. 4,446,519 to Thomas discloses a method for providing security for computer software by providing each purchaser of a software package with an electronic security device which must be operatively connected to the purchaser's computer. The software sends coded interrogation signals to the electronic security device which processes the interrogation signals and transmits coded response signals to the software. The programs will not be executed unless the software recognizes the response signals according to preselected security criteria.

U.S. Pat. No. 4,757,534 to Matyas, et al., discloses a cryptographic method for discouraging the copying and sharing of purchased software programs while allowing an encrypted program to be run on only a designated computer or, alternatively, to be run on any computer but only by the user possessing a designated smart card. Each program offering sold by the software vendor is encrypted with a unique file key and then written on a diskette. A user who purchases a diskette having written thereon an encrypted program must first obtain a secret password from the software vendor. This password will allow the encrypted program to be recovered at a prescribed, designated computer having a properly implemented and initialized encryption feature. The encryption feature decrypts the file key of the program from the password, and when the encrypted program is loaded at the proper computer, the program or a portion of it is automatically decrypted and written into a protected memory from which it can only be executed and not accessed for non-execution purposes.

As the reader will see from the cited prior art, the traditional problem of unauthorized copying and use of programs has been to make it hard, or in some cases difficult, to copy part or all of the program once it has been decrypted within the secure cryptographic processor. This can be done by executing the program on the decryption chip itself or by transferring the decrypted program, or a designated portion of the decrypted program, from the secure cryptographic processor to a protected memory it is executed. Problems associated with software distribution over an open channel or using high-density stamped media are overlooked or neglected.

OBJECTS OF THE INVENTION

It is therefore an object of the invention to provide an improved method of multimedia software distribution over an open channel or using high-density stamped media.

It is another object of the invention to provide a cryptographic method for the protection of multimedia program and data files distributed over an open channel or using high-density stamped media.

It is another object of the invention to provide a means for controlling access to multimedia programs and data files distributed over an open channel or using high-density stamped media so that an authorized user can access (i.e., decrypt and recover) files he/she has purchased and licensed but an unauthorized user cannot access (i.e., decrypt and recover) files he/she has not purchased and licensed.

It is another object of the invention to provide a means for using cryptographic keys -- consisting of customer and data keys -- to control access to encrypted multimedia files.

It is another object of the invention to provide a means for associating and tracing a customer key to a particular customer or user, thereby discouraging users from sharing keys or posting them on a computer bulletin board.

It is another object of the invention to provide a means for tracing customer keys to customers by assigning a unique customer number to each customer and by making the customer number a sub-portion of the clear customer key.

It is another object of the invention to provide a means whereby encrypted multimedia files cannot be decrypted except at a user processor with a capability for multimedia file recovery, as specified by the invention. That is, an encrypted file and the keys needed for decrypting the file are not, by themselves, enough to decrypt the file.

It is another object of the invention to provide a multimedia file recovery procedure that makes use of a copyright-protected function which is new and unique to the file recovery procedure (i.e., the function does not exist in any book or printed literature to which a user can easily be directed), which is complex (i.e., one cannot easily provide a written description of the function except by directly copying it), and which is of modest size (i.e., if the function is copied, and possibly posted on a computer bulletin board, it will be conspicuous because of its size).

It is another object of the invention to provide a means for cryptographic keys to be self-authenticating based on authentication information stored within the keys themselves. This will help to minimize cases of incorrectly initialized keys and incorrectly decrypted files.

It is another object of the invention to provide a key management scheme that supports software distribution from both a central software distribution facility and from merchants who contract with the software vendor and receive the necessary pre-calculated keys to be given to customers who purchase multimedia software.

SUMMARY OF THE INVENTION

These and other objects, features, and advantages are accomplished by the invention disclosed herein.

Unlike much of the prior art, the present invention does not solve, or attempt to solve, the traditional problem of unauthorized copying and use of programs. That is, the invention does not solve the problem of copying software once it has been received and decrypted at a user processor. An assumption is made that ordinary software licences and copyright protection law are sufficient to deter such unauthorized copying and use of programs once they have been received and decrypted.

Instead, the invention describes a cryptographic means for protecting software distributed over an open channel or via a high-density stamped medium. For software files purchased by a user, the method provides an easy means to decrypt and recover the software files at a user processor. The method is based on the use of encryption keys issued to the user by the software distribution processor. These encryption keys, when initialized in the user processor, enable file recovery to take place. The method is also such that it is difficult for a user to circumvent security and decrypt an encrypted file without possessing a customer-unique key (called a customer key) and without possessing the correct encrypted file key needed to "unlock" or decrypt the encrypted file.

Each multimedia file is encrypted with a secret data key (KD). The same data key can encrypt multiple files if there is some logical association of the files (e.g., files are grouped and sold as a unit).

The encrypted files are distributed over an open channel or via high-density stamped media. Those skilled in the art will recognize that the invention is not limited to only these two methods of software distribution, but that the invention is aimed at solving a problem particular to these two methods of software distribution.

Each customer who purchases multimedia software is given a unique customer key. The customer key contains a customer-unique customer number, which is assigned and provided to the customer using means outside the scope of the present invention. The invention permits multiple customer numbers and customer keys to be provided to a single customer. For example, a large customer like General Motors may have many customer numbers, so that software orders can be placed by many groups or areas within a single large corporation or business.

When a customer purchases multimedia software from a software distribution facility, the customer provides his/her customer number. The customer key is produced from a set of variables consisting of an assigned customer number, a counter (arbitrarily set to zero), and a secret key-generating key (KGK) known only to the software distribution center. A special copyright-protected function (f) is then used to derive a variant customer key (KC') from the customer key. The data key(s) associated with the multimedia file(s) purchased by the customer are then encrypted with the variant customer key. The clear customer key and the encrypted file key(s) are provided to the customer (e.g., transmitted electronically from the software distribution processor to the user processor, written on a diskette and mailed to the customer, or orally transmitted over a telephone). At the user processor, the keys and encrypted file(s) are initialized and made available to the file recovery program. The file recovery program decrypts and recovers the file(s). When a customer purchases additional software, he/she will receive one or more encrypted data keys to permit the encrypted files to be recovered. As the clear customer key will be the same as before, a clear customer key may or may not be provided. The system will be able to recover the previously entered customer key to avoid having the user being required to re-enter it. Alternately, the user can enter it, as desired.

When software is purchased from an independent merchant, the customer will receive a pre-generated customer key issued in advance to the merchant. The pre-generated customer keys are supplied to the merchant by the software distribution center (e.g., IBM software distribution center). For example, a merchant who orders 200 OS/2 licenses would receive 200 CD-ROMs and 200 shrink-wrapped license packets. Each license packet would have a sheet of paper with a customer key printed on it. The customer keys given to each merchant are produced from a set of variables consisting of an assigned customer number given to the merchant, an incrementing counter associated with the merchant, and a secret key-generating key. When the keys are generated for a merchant, the counter is incremented for each license issued and thus, the merchant would receive 200 different customer keys. In this case, the software distribution center must only keep track of the number of keys issued to each merchant. The merchant's customer number, at the front of the customer key, would be the same for each generated key.

BRIEF DESCRIPTION OF THE DRAWINGS

These and other objects, features, and advantages of the invention will be more fully appreciated with reference to the accompanying figures.

FIG. 1 is a block diagram illustrating multimedia software distribution from a software distribution processor to a user processor.

FIG. 2 is a block diagram illustrating multimedia software distribution from a software distribution processor to a merchant processor and from the merchant processor to a user processor.

FIG. 3 is a block diagram further amplifying and illustrating multimedia software distribution from a software distribution processor belonging to a software vendor to a user processor belonging to a user.

FIG. 4 is a block diagram illustration of cryptographic subsystem 100 at software distribution processor 10.

FIG. 5 is a block diagram illustration of the method for encrypting a key-generating key using a variant key produced from the master key KM and a control vector associated with the key-generating key.

FIG. 6 contains a specification for the control vectors KGKLCV and KGKRCV associated with the left and right 64-bit parts of key-generating key KGK.

FIG. 7 is a block diagram illustration of a KGK record.

FIG. 8 is a block diagram illustration of the method for encrypting a data key using a variant key produced from the master key KM and a control vector associated with the data key.

FIG. 9 is a block diagram illustration of a KD-record.

FIG. 10 is a block diagram illustration of the method for encrypting a data key with a variant customer key KC'.

FIG. 11 is a block diagram illustration of cryptographic subsystem 200 at user processor 20.

FIG. 12 is a block diagram illustration of the sequence of API-callable services that must be performed to accomplish software distribution from software distribution center 10 to user processor 20.

FIG. 13 is a block diagram illustration of the process for producing a customer key with the Generate Customer Key (GCK) internal function 113 available in cryptographic subsystem 100 of software distribution processor 10, as shown in FIG. 4.

FIG. 14 is a block diagram illustration of software distribution from a software distribution processor 10 to a user processor 20.

FIG. 15 is an example list of software to be purchased from a software vendor.

FIG. 16 is an illustration of a shrink wrapped package containing a stamped medium and a piece of paper on which is printed a clear customer key KC and an encrypted ith file key e*KC'(KDi), where KC' is the variant customer key produced from KC.

DESCRIPTION OF THE BEST MODE FOR CARRYING OUT THE INVENTION

The invention describes a method for multimedia software distribution in situations where a user purchases software directly from a software vendor or where a user purchases software from an independent merchant who purchases the software from a software vendor.

FIG. 1 is a block diagram illustrating multimedia software distribution from a software distribution processor 10 belonging to a software vendor such as IBM to a user processor 20 belonging to a user. The purchased/licensed multimedia software is distributed as one or more encrypted multimedia files and a set of cryptographic keys that permit the encrypted multimedia files to be decrypted and recovered at the user processor.

FIG. 2 is a block diagram illustrating multimedia software distribution from a software distribution processor 10 belonging to a software vendor to a third party merchant 15 and thence from the third party merchant 15 to a user processor 20 belonging to a user. In this case, the merchant purchases software from the software vendor at a wholesale price for subsequent re-sale to users at a retail price. The merchant is a customer of the software vendor and the user is a customer of the merchant.

FIG. 3 is a block diagram further amplifying and illustrating multimedia software distribution from a software distribution processor 10 belonging to a software vendor (e.g., IBM) to a user processor 20 belonging to a user. The multimedia programs and files distributed via this method shall be referred to as files or multimedia files. Software distribution processor 10 contains a cryptographic subsystem 100 for performing data encryption and other key management services, a key generation means 150 for generating keys, an encrypted file generation means 160 for encrypting files, an encrypted file distribution means 170 for packaging and transmitting encrypted files, and a key distribution means 180 for packaging and transmitting keys. Keys generation means 150 invokes cryptographic subsystem 100 to execute key management services. File encryption means 160 invokes cryptographic subsystem 100 to encrypt files. User processor 20 contains a comparable cryptographic subsystem 200 for performing data decryption and other key management services, a key recovery means 250 for validating and decrypting keys, and a file recovery means 260 for decrypting encrypted files. Key recovery means 250 invokes cryptographic subsystem 200 to execute key management services. File recovery means 260 invokes cryptographic subsystem 200 to decrypt files. Encrypted files are distributed from software distribution processor 10 to user processor 20 using an encrypted file distribution medium 30. Cryptographic keys are distributed from software distribution processor 10 to user processor 20 using a key distribution medium 31.

Referring again to FIG. 3, a file is encrypted at software distribution processor 10 by first requesting a data key from key generation means 150. A data key is generated by invoking a cryptographic service provided by cryptographic subsystem 100. In response, key generation means 150 generates a data key -- a copy of which is delivered to encrypted file generation means 160 and a copy of which is saved within key generation means 150 for subsequent use by key distribution means 180. The so-generated data key is next used by encrypted file generation means 160 to encrypt the specified file, which is saved within encrypted file generation means 160 for subsequent use by encrypted file distribution means 170. Data is encrypted by invoking a cryptographic service provided by cryptographic subsystem 100. If encrypted file distribution medium 30 is a high-density stamped medium such a CD-ROM, then encrypted file distribution means 170 includes methods for the production and distribution of CD-ROMs. For example, CD-ROM production would include the steps of selecting a set of files, causing the files to be encrypted using encrypted file generation means 160, and manufacturing CD-ROM copies for distribution. CD-ROMs can be distributed using the U.S. postal service or similar delivery service such as Federal Express, or they can be shipped to selected distribution points where they are picked up by customers. If encrypted file distribution medium 30 is an open channel, the encrypted file distribution means 170 transmits the so-produced encrypted files via the open channel (telephone lines, TV-cable, satellite or radio broadcast) according to a pre-arranged schedule prepared by the software vendor. In any case, encrypted file distribution means 170 ensures that encrypted files are distributed to customers in an efficient and timely manner.

In response to a customer order for multimedia software (consisting of one or more multimedia files) key generation means 150 produces a unique customer key from information including a unique customer number supplied by the customer. A customer key is generated by invoking a cryptographic service provided by cryptographic subsystem 100. Key generation means 150 next produces a variant customer key from the so-produced customer key. The so-produced variant customer key is then used to encrypt one or more data keys. A data key is encrypted with a system-generated variant customer key by invoking a cryptographic service provided by cryptographic subsystem 100. The data keys encrypted with the variant customer key are the data keys associated with the purchased files, i.e., the data keys that were originally used to encrypt said purchased files. The so-produced customer key and the so-produced encrypted data keys are provided to key distribution means 180, which in turn transmits the keys to user processor 20 using key distribution medium 31. Key distribution medium 31 can be a communications channel permitting the key to be electronically transmitted from software distribution processor 10 to user processor 20. Key distribution medium 31 can be a diskette permitting the keys to be delivered via the U.S. postal service or similar delivery service such as Federal Express. Key distribution medium 31 can be a telephone connection permitting the keys to be delivered orally to the user. In the preferred embodiment of the invention, keys are delivered using automatic means which do not require users to write keys down on paper or to enter keys using a key-pad. However, such manual key handling techniques are not precluded by the invention, and those who wish to practice the invention in this way can do so.

For each encrypted file transmitted via file distribution medium 30, there is an encrypted data key transmitted via key distribution medium 31. A file identifier is also transmitted together with each encrypted data key, thus permitting an encrypted data key to be correctly associated with its respective encrypted file. A data key can be associated with one or more encrypted files depending on whether the multimedia software consists of a single multimedia file or whether it is a entire product consisting of several multimedia files. The reader will appreciate that the file identifier is not a crucial element of the subject invention and also that there are many ways in which the file identifier can be defined in a practical implementation of the subject invention.

At user processor 200, key and file recovery takes place as follows. Key recovery means 250 first authenticates the customer key and each encrypted data key received via key distribution medium 31. Keys are authenticated by invoking cryptographic services provided by cryptographic subsystem 200. A key is discarded and not used if it fails to be authenticated, although it shall be assumed here that the key authentication step succeeds. For each encrypted file to be recovered, the file identifier associated with the encrypted file is used to identify an encrypted data key to be decrypted. This so-identified encrypted data key received via key distribution medium 31 is decrypted via key recovery means 250 using a variant customer key produced from customer key received via key distribution medium 31. Data keys are decrypted by invoking a cryptographic service provided by cryptographic subsystem 200. The so-recovered clear data key is provided to file recovery means 260 which then uses the key to decrypt the encrypted file received via file distribution medium 30. Data is decrypted by invoking a cryptographic service provided by cryptographic subsystem 200. The so-recovered file is provided to user processor 20. The process of file recovery thus proceeds until each encrypted file is decrypted. The reader will appreciate that the file recovery process can be performed as a single batch operation wherein each of the encrypted files received via file distribution medium 30 is decrypted and provided to user processor 20 as a unit. Conversely, the file recovery process can occur in a more dynamic manner in which a file is recovered when access to the file is needed. In this case, the recovered file can be stored in clear form within user process 20 so that subsequent requests for the file will result in accessing the clear stored copy of the file. Likewise, it is possible to discard the recovered file once it has been used so that subsequent requests for the file will cause the file recovery process to re-invoked (i.e., the data key is decrypted and the file is decrypted again with the clear data key). The informed reader will appreciate that there are many ways in which file recovery can be performed without departing from the spirit of the subject invention.

FIG. 4 is a block diagram illustration of cryptographic subsystem 100. Cryptographic subsystem 100 contains a Data Encryption Algorithm (DEA) 101 capable of performing elementary operations of encryption and decryption, a random number (RN) generator 102 for generating 64-bit random numbers used in the process of key generating, a master key storage 103 for the storage of a 128-bit master key (KM), a set of API-callable services 120 for performing data encryption and key management functions required by the software distribution processor 10, and a set of internal functions 110 which are called by the API services and which eliminate processing redundancies within and maintain consistency across the set of API-callable services 120.

The DEA 101 contains a copy of the Data Encryption Algorithm (DEA). The DEA is a block cipher that encrypts a 64-bit plaintext with a 64-bit key to produce a 64-bit ciphertext. The notation eK(X) denotes encryption of 64-bit plaintext X with 64-bit key K. The notation e*K(X) denoted the encryption of 64-bit plaintext X with 128-bit key K, i.e., the asterisk ("*") denotes encryption with a doubled length key. Of the 64 bits in the key, 56 bits are independent key bits. The remaining 8 non-key bits (7, 15, 23, 31, 39, 47, 55, 63) may be used for parity error checking purposes. For example, bit 7 is set so that byte 1 has odd parity, bit 15 is set so that byte 2 has odd parity, etc.

Random number generator 102 may be a true random number generator or a pseudorandom number generator. This distinction is unimportant to the present invention.

In the present invention, master key storage 103 contains a fixed constant master key. However, those skilled in the art will recognize that provision can easily be made for the master key to be a variable initialized in the cryptographic subsystem, e.g., by manual key entry through a cable-attached keypad. Such a method of master key entry is described in U.S. Pat. No. 4,941,176 to Matyas et al.

The API Services 120 include Clear Key-Generating Key Install 121, Data Key Generate 122, Encrypt With Verify 123, Clear Customer Key Generate 124, and Data Key Export 125. Those skilled in the art will recognize that cryptographic subsystem 100 can contain other API services such as a Cryptographic Sub-system Initialize service for initializing the cryptographic subsystem prior to its use, a Master Key Update service allowing a master key to be initialized or changed within the cryptographic subsystem, and a Verification Data Encrypt service for calculating a very high-integrity verification value to be used at a user processor for authenticating a data key before it is used for decrypting data. While such services enhance the utility of the cryptographic subsystem, they are not a crucial part of the subject invention. The Internal Functions 110 include Hash Passphrase (HP) 111, Set Data Key Error Checking Bits (SDKECB) 112, Generate Customer Key (GCK) 113, Generate Derived Part (GDP) 114, Set Customer Key Error Checking Bits (SCKECB) 115, and Generate Variant Customer Key (GVCK) 116.

Referring again to FIG. 4, the Clear Key-Generating Key Install function 121 produces a 128-bit key-generating key (KGK) from a 1 to 80 character input passphrase using the Hash Passphrase (HP) internal function 111. The HP function consists of the following steps:

1. Set X1:=passphrase

2. Pad X1 (on the right) with enough space characters to make X1 80 characters in length.

3. Encrypt X1 with key X'0101010101010101' and initial chaining value X'0000000000000000' using CBC mode of DEA encryption. The CBC mode of encryption is described in detail in U.S. Pat. No. 4,918,728 to Matyas et al.

4. Set KGKL:=rightmost 8 bytes of X1.

5. Set X2:=passphrase

6. Pad X2 (on the right) with enough space characters to make X2 80 characters in length.

7. Encrypt X2 with key X'1010101010101010' and initial chaining value X'0000000000000000' using CBC mode of DEA encryption.

8. Set KGKR:=rightmost 8 bytes of X2.

9. Set KGK:=concatenation of KGKL and KGKR

10. Adjust KGK for odd parity (i.e., counting bits as 0, 1, . . . , 127, set bit 7 so that bits 0, 2, . . . , 7 have an odd number of 1 bits, set bit 15 so that bits 8, 9, . . . , 15 have an odd number of 1 bits, and so forth.

11. Return KGK as the output key-generating key.

The so-produced key-generating key KGK is encrypted with a variant key produced from the master key and a control vector associated with the key-generating key, as illustrated in FIG. 5. Referring to FIG. 5, the left 64-bit part (KGKL) of key-generating key KGK is encrypted with variant keys KML+KGKLCV and KMR+KGKLCV, where KML+KGKLCV is the Exclusive OR product of the left 64-bit part of master key KM and KGKLCV is a 64-bit control vector associated with the left 64 bits of key-generating key KGK and KMR+KGKLCV is the Exclusive OR product of the right 64-bit part of master key KM and KGKLCV is a 64-bit control vector associated with the left 64-bits of key-generating key KGK. The process of encryption consists of encrypting KGKL with KML+KGKLCV, decrypting the result with KMR+KGKLCV, and then encrypting that result with KML+KGKLCV. The right 64-bit part (KGKR) of key-generating key KGK is encrypted with variant keys KML+KGKRCV and KMR+KGKRCV, where KML+KGKRCV is the Exclusive OR product of the right 64-bit part of master key KM and KGKRCV is a 64-bit control vector associated with the right 64 bits of key-generating key KGK and KMR+KGKRCV is the Exclusive OR product of the right 64-bit part of master key KM and KGKRCV is a 64-bit control vector associated with the right 64-bits of key-generating key KGK. The process of encryption consists of encrypting KGKR with KML+KGKRCV, decrypting the result with KMR+KGKRCV, and then encrypting that result with KML+KGKRCV. FIG. 6 contains a specification for the control vectors KGKLCV and KGKRCV associated with the left and right 64-bit parts of key-generating key KGK. The control vector values are fixed constants stored within cryptographic subsystem 100, although they are not shown in FIG. 4. The so-encrypted key-generating key is stored in a KGK-record, which is returned as an output. FIG. 7 is a block diagram illustration of a KGK-record. A KGK-record consists of a 1-byte flag (=X'19'), a 15-byte reserved field, a 16-byte key field containing the 128-bit encrypted key-generating key, a 16-byte control vector field containing an 8-byte control vector associated with KGKL (i.e., with the left 64 bits of KGK) concatenated with an 8-byte control vector associated with KGKR (i.e., with the right 64 bits of KGK), and a 16-byte reserved field.

The Data Key Generate function 122 produces a 64-bit encrypted data key which is stored in a data key record (KD-record) and returned as an output. The 64-bit data key is produced by requesting a 64-bit random number (RN) from RN generator 102 and then setting the error checking bits in random number (RN) using the Set Data Key Error Checking Bits (SDKECB) internal function 112. The input to the SDKECB function is a 64-bit random number RN; the output is a 64-bit data key with its error checking bits set. The SDKECB function consists of the following steps:

1. Set K:=RN AND X'FEFEFEFEFEFEFEFE'

2. Set MAC:=64-bit message authentication code calculated on K using a fixed key of X'0123456789ABCDEF'. The message authentication code, in this case, is the 64-bit ciphertext produced by encrypting the plaintext K with the key X'0123456789ABCDEF'. The procedure or algorithm for calculating 64-bit message authentication codes is described in U.S. Pat. No. 4,918,728 to Matyas et al.

3. Set Z:=MAC AND X'0101010101010101'

4. Set KD:=K XOR Z

5. Return KD as the output data key.

Note that the "AND" operation is a bitwise operation where B'0' AND B'0'=B'0', B'0' AND B'1'=B'0', B'1' AND B'0'=B'0', AND B'1'=B'1'. Note that "XOR" represents the Exclusive OR operation, or bitwise addition modulo 2. The so-produced data key is encrypted with a variant key produced from the master key and a control vector associated with the data key, as illustrated in FIG. 8. Referring to FIG. 8, KD is encrypted with variant keys KML+KDCV and KMR+KDCV, where KML+KDCV is the Exclusive OR product of the left 64-bit part of master key KM and KDCV is a 64-bit control vector associated with KD and KMR+KDCV is the Exclusive OR product of the right 64-bit part of master key KM and KDCV is a 64-bit control vector associated KD. The process of encryption consists of encrypting KD with KML+KCDV, decrypting the result with KMR+KDCV, and then encrypting that result with KML+KDCV. FIG. 6 contains a specification for the control vector KDCV associated with the data key KD. FIG. 9 is a block diagram illustration of a KD-record. A KD-record consists of a 1-byte flag (=X'19'), a 15-byte reserved field, a 16-byte key field containing an 64-bit encrypted data key, a 16-byte control vector field containing an 8-byte control vector associated with KD, and a 16-byte reserved field.

The Encrypt With Verify function 123 encrypts input data with a data key contained in an input data key record (KD-record) to produce encrypted data of the form eKD(0, data), 0 represents an initial chaining value and data represents data of consisting of 64-bit blocks. Data is encrypted with the Cipher Block Chaining (CBC) mode of DEA encryption using an initial chaining value (or initilization vector) of zero. The CBC mode of encryption is described in detail in U.S. Pat. No. 4,918,728 to Matyas et al. Before the data key KD can be used, it must be retrieved from the input KD-record and decrypted. The encrypted data key is decrypted with a variant key produced from the master key and a control vector associated with the data key. The decryption process is the inverse of the encryption process shown in FIG. 8. That is, the encrypted value of KD is decrypted with KML+KDCV, the result is encrypted with KMR+KDCV, and that result is decrypted with KML+KDCV to recover KD. The process of encrypting the input data consists of the steps of (1) encrypting the data with KD, (2) decrypting the encrypted data with KD, (3) comparing the decrypted data with the original data for equality, and (4) returning the encrypted data as an output only if the comparison operation in step 3 succeeds. This sort of verification on the data is performed as a preventative measure to reduce the chance that one is unable to decrypt encrypted data on a CD-ROM. It would be unfortunate if one discovered that encrypted data on a CD-ROM could not be decrypted after tens or hundreds of thousands of CD-ROM copies had been produced.

The Clear Customer Key Generate function 124 produces a clear 128-bit customer key from a 10 decimal digit customer number, a 32-bit counter value CTR, and a key-generating key contained in a KGK-record, all of which are supplied as inputs to the function. The process of generating a clear customer key consists of the following steps:

1. Retrieve the encrypted value of KGK from the input KGK-record and decrypt it with the master key. The encrypted value of KGK is decrypted with a variant key produced from the master key and a control vector associated with KGK. The decryption process is the inverse of the encryption process shown in FIG. 5.

2. Set KC:=128-bit value produced by the Generate Customer Key (GCK) internal function 113, where the inputs to the GCK function are the 10 decimal digit customer number, the 32-bit counter, and the 128-bit KGK recovered at step 1 above.

3. Return KC as the output customer key.

The Generate Customer Key (GCK) function 113 produces a 128-bit customer key from a 10 decimal digit customer number, a 32-bit counter CTR, and a 128-bit key-generating key KGK. The GCK function consists of the following steps:

1. convert each decimal digit of the customer number to a 4-bit "nibble" (i.e., 0=B'0000', 1=B'0001', 2=B'0010', etc.), concatenate the 10 4-bit "nibbles", and store the 40-bit value as CN.

2. Set KCL:=concatenation of CN, CTR, X'FF', and X'0000', where CTR is the 32-bit input counter value.

3. Set KCR:=intermediate 64-bit value DP produced by the Generate Derived Part (GDP) function 114 using CN, CTR, and KGK as function inputs.

4. Set KC:=128-bit value produced by the set Customer Key Error Checking Bits (SCKECB) function 115, where the input to the SCKECB function is the 128-bit value of key.sub.-- in produced as the concatenation of KCL (produced at step 2 above) and KCR (produced at step 3 above).

5. Return KC as the output customer key.

The Generate Derived Part (GDP) function 114 generates a 64-bit intermediate value DP from a 40-bit customer number CN, a 32-bit counter CTR, and a 128-bit key-generating key KGK. The intermediate value DP is used in the production of a customer key. The GDP function 114 consists of the following steps:

1. Set X1:=the value of CN padded on the right with zero bits to make a 64-bit block.

2. Set X2:=the value of CTR padded on the left with zero bits to make a 64-bit block.

3. Set X:=concatenation of X1 and X2.

4. Set Y:=final 64-bit block of ciphertext produced by encrypting X with KGL (i.e., the leftmost 64-bits of KGK) and initial chaining value X'0000000000000000' using CBC mode of DEA encryption.

5. Set DP:=value produced by decrypting Y with KGR (i.e., the rightmost 64-bits of KGK) and encrypting that result with KGL (i.e., the leftmost 64-bits of KGK).

6. Return the derived part DP as an output.

The Set Customer Key Error Checking Bits (SCKECB) function 115 sets the error checking bits in a 128-bit customer key. The input to the SCKECB function is a 128-bit value called key.sub.-- in, which is an intermediate value produced by the Clear Customer Key Generate function; the output is a 128-bit customer key KC with its error checking bits set. The SCKECB function consists of the following steps:

1. Set K:=key.sub.-- in AND X'FFFFFFFFFFFF0000FEFEFEFEFEFEFEFE'.

2. Set MAC:=64-bit message authentication code calculated on K using a fixed key of X'0123456789ABCDEF'. The procedure for calculating a message authentication code is described in U.S. Pat. No. 4,918,728 to Matyas et al.

3. Set Y:=MAC AND X'000000000000FFFF'.

4. Set KL':=KL XOR Y, where KL is the leftmost 64 bits of K.

5. Set MAC':=value produced by encrypting MAC with key X'0123456789ABCDEF' using Electronic Code Book (ECB) mode of DEA encryption. The ECB mode of DEA encryption is described in U.S. Pat. No. 4,918,728 to Matyas et al.

6. Set Z:=MAC' AND X'0101010101010101'.

7. Set KR':=KR XOR Z, where KR is the rightmost 64 bits of K.

8. Set KC:=concatenation of KL' and KR'.

9. Return KC as the output customer key.

Note that "AND" represents a bitwise operation where B'0' AND B'0'=B'0', B'0' AND B'1'=B'0', B'1' AND B'0'=B'0', and B'1' AND B'1'=B'1'. Note that "XOR" represents the Exclusive OR operation, or bitwise addition modulo 2.

The Data Key Export function 125 produces an encrypted data key of the form e*KC'(KD) -- defined as the encryption of KD with a 128-bit variant customer key KC' -- from a 10 decimal digit customer number, a 32-bit counter, a 128-bit key-generating key contained in a 64-byte KGK-record, and a 64-bit data key contained in a 64-byte KD-record. The process of generating e*KC'(KC) consists of the following steps:

1. Retrieve the encrypted value of KGK from the input KGK-record and decrypt it with the master key. The encrypted value of KGK is decrypted with a variant key produced from the master key and a control vector associated with KGK. The decryption process is the inverse of the encryption process shown in FIG. 5.

2. Retrieve the encrypted value of KD from the input KD-record and decrypt it with the master key. The encrypted value of KD is decrypted with a variant key produced from the master key and a control vector associated with KD. The decryption process is the inverse of the encryption process shown in FIG. 8.

3. Set KD:=128-bit value produced by the Generate Customer Key (GCK) internal function 113, where the inputs to the GCK function are the 10 decimal digit customer number, the 32-bit counter, and the 128-bit KGK recovered at step 1 above.

4. Set KC':=128-bit value produced by the Generate Variant Customer Key (GVCK) function 116, where the input to the GVCK function is the customer key KC. (The GVCK function is also called function f elsewhere in the description of the subject invention.)

5. Set e*KC'(KD):=value produced by encrypting KD with KC' using the method illustrated in FIG. 10. The method consists of encrypting KD with KCL', the leftmost 64 bits of KC', decrypting the result with KCR', the rightmost 64 bits of KC', and finally encrypting that result with KCL'.

6. Return e*KC'(KD) as the output encrypted data key.

The Generate Variant Customer Key (GVCK) function 116 generates a 128-bit variant customer key KC' from a 128-bit customer key KC. The GVCK function is also referred to as function f elsewhere in the subject invention. Function f can, in the simplest case, be an identity function that merely sets KC':=KC, if there is some perceived advantage in doing so. In fact, function f can be any function that is desired, including a 1-way function or a 2-way function where an inverse function f-inv exists such that KC:=f-inv(KC'). In the preferred embodiment of the invention, function f is a one-way function (not an encryption function) so that for practical purposes calculating KC from KC' is considered computationally difficult or hard. In effect, this eliminates a potential problem in obtaining a U.S. Government export license for products containing function f. In any case, the objectives of function f can be achieved with a 1-way or 2-way function. The objectives of function f are these:

1. To provide a means whereby encrypted multimedia files cannot be decrypted except at a user processor with a capability for multimedia file recovery, as specified by the invention. That is, an encrypted file and the keys needed for decrypting the file are not, by themselves, enough to decrypt the file.

2. To provide a multimedia file recovery procedure that uses a copyright-protected function (f) which is new and unique to the file recovery procedure (one cannot refer to the function elsewhere in the open literature), which is complex (one cannot easily describe it), and which is of modest size (it is not easily hidden if copied and stored within a computing system).

It should be pointed out that the left half of the customer key KC can become the left half of the variant customer key KC' directly, while the right half of the customer key KC is used to produce the right half of the variant customer key KC'. The left half of the customer key is termed KCL and the right half of the customer key is termed KCR. The left half of the variant customer key is termed KCL' and the right half of the variant customer key is termed KCR'.

It should also be pointed out that all of the following examples use a large file (say 8,000 bytes) that contains copyright information, for example, "COPYRIGHT 1992 BY IBM" and other data. One of the goals in the construction of this file is that it is difficult to compress it and store it in a much shortened form. One way to achieve this is to have much of the data in the file be random or appear to be random. The data that appears to be random could be produced by the encryption of a highly structured clear file that is itself copyright protected. The encryption key in this case is a secret known only to the creator of the file. The goal is to require the adversary trying to simulate the process of deriving the variant customer key to use the large file or a derivative file to do the simulated calculation thus aiding in showing the violation of copyright. This large file is termed the copyright file.

A first example of function f is to use DEA ECB encryption on the copyright file. The right half of the customer key KC is the encryption key. The ciphertext is then reduced via a one-way process to the needed size to produce the right half of the variant customer key. This may be done, for example, via an exclusive-OR operation or an addition modulo 2**64 operation where ** indicates exponentiation. As a final step, the value may be adjusted to have odd byte parity. Other combining functions are possible. In this case, the left half of the variant customer key is set equal to the left half of the customer key.

A second example of function f is to use DEA CBC encryption of the copyright file. The right half of the customer key KC is used as the encryption key to encrypt the copyright file. The last 64-bit block of ciphertext is used as the right half of the customer key variant, after adjusting for odd byte parity. In this case, the left half of the variant customer key is set equal to the left half of the customer key.

A third example of function f is to prefix the copyright file with the value of the customer key KC and to execute MDC-2 or MDC-4 on the result to produce the output 128-bit MDC which is the value of the customer key variant, after adjusting for key parity. For a description of the MDC-2 or MDC-4 process, see U.S. Pat. No. 4,908,861 (found in the list of prior art).

As a fourth example, the copyright file is used as the key for a mixing process, as follows:

1. Set the accumulator register to the value of the customer key KC.

2. Set the copyright file bit pointer to the first bit in the file.

a. Read the value of the bit in the copyright file corresponding to the bit pointer.

b. If the bit has a value of 0, execute substitution function 1 on the contents of the accumulator register.

c. Else, execute substitution function 2 on the contents of the accumulator register.

d. Execute permutation function 1 on the contents of the accumulator register.

e. If bit pointer is at end of copyright file, exit. The contents of the accumulator register at this time is the value of the variant customer key variant, after adjusting it for odd byte parity.

f. Else increment the value of the bit pointer and go to the top of the loop to read the value of the next bit in the copyright file.

Substitution function 1 and substitution function 2 are different functions that examines each byte in the accumulator register and replaces it with another value.

For example, substitution function 1 could be defined as follows, all values are in decimal:

__________________________________________________________________________S1 input S1 output__________________________________________________________________________ 0 . . . 15 204    63 211          90 168                161                   231                      225                         103                            118                               154                                  206                                     120                                        201                                           235                                              7116 . . . 31 88 219       200          128             102                224                   125                      241                         177                            160                               45 21 78 23 19 18332 . . . 47 194    113       232          1  130                159                   133                      234                         202                            170                               137                                  127                                     39 22 35 13148 . . . 63 101    51 176          10 227                3  73 157                         209                            83 20 179                                     172                                        218                                           248                                              22264 . . . 79 62 56 165          163             190                5  32 217                         230                            104                               150                                  64 42 184                                           249                                              17180 . . . 95 85 121       180          117             220                189                   245                      75 8  98 188                                  77 87 17 53 6 96 . . . 111 129    210       247          213             72 187                   114                      115                         55 111                               93 156                                     105                                        126                                           44 41112 . . . 127 34 254       186          253             228                110                   97 91 82 255                               119                                  238                                     152                                        173                                           136                                              11128 . . . 143 174    58 7  240             46 199                   76 30 233                            169                               29 26 16 162                                           149                                              237144 . . . 159 196    239       178          138             108                74 242                      36 182                            37 89 221                                     164                                        205                                           94 68160 . . . 175 175    96 250          50 99 140                   243                      70 100                            122                               12 66 146                                        43 109                                              216176 . . . 191 81 132       236          135             139                79 95 84 166                            151                               142                                  148                                     67 18 65 192192 . . . 207 144    123       92 38 31 158                   185                      214                         27 28 208                                  59 191                                        49 244                                              252208 . . . 223 198    223       141          107             1  95 124                      153                         229                            197                               5  86 207                                        147                                           226                                              145224 . . . 239 60 54 61 212             25 134                   24 193                         52 0  40 33 167                                        15 13 2240 . . . 255 14 4  80 143             155                47 251                      215                         106                            112                               69 2469                                     48 116                                           203                                              181__________________________________________________________________________

For example, the substitutes for 0, 1, and 2 are 14, 204 and 63, respectively.

Substitution function 2 could be defined as follows, all values are in hexadecimal:

__________________________________________________________________________S2 input S2 output__________________________________________________________________________ 0 . . . 15 214    158       73 249             112                104                   179                      91 229                            87 143                                  207                                     243                                        204                                           34 13316 . . . 31 56 219       109          157             114                79 139                      11 28 82 184                                  245                                     240                                        163                                           6  25432 . . . 47 218    135       174          200             30 66 52 59 255                            132                               75 37 76 41 70 17648 . . . 63 164    149       5  216             153                23 122                      250                         113                            165                               166                                  42 31 198                                           247                                              14564 . . . 79 120    144       160          173             80 208                   63 203                         185                            236                               202                                  209                                     210                                        48 55 15280 . . . 95 15 12 77 215             239                62 47 58 156                            123                               39 21 140                                        134                                           213                                              115 96 . . . 111 205    168       253          36 242                0  251                      169                         226                            17 171                                  196                                     83 124                                           106                                              182112 . . . 127 129    211       96 177             241                2  65 90 189                            89 71 192                                     32 146                                           45 116128 . . . 143 93 121       170          40 100                35 94 131                         137                            74 60 43 167                                        161                                           223                                              148144 . . . 159 92 51 69 155             225                111                   72 78 88 103                               248                                  191                                     235                                        27 107                                              119160 . . . 175 227    188       238          127             154                197                   190                      232                         237                            180                               147                                  101                                     187                                        150                                           19 16176 . . . 191 81 8  130          125             25 194                   105                      7  38 9  24 95 199                                        252                                           228                                              138192 . . . 207 49 1  141          151             186                221                   117                      234                         33 206                               50 224                                     178                                        222                                           233                                              22208 . . . 223 10 172       175          230             13 84 183                      231                         26 220                               118                                  54 102                                        18 195                                              136224 . . . 239 98 3  212          99 246                44 85 14 162                            128                               201                                  126                                     20 86 110                                              159240 . . . 255 53 142       61 68 97 64 29 244                         4  108                               46 57 67 193                                           181                                              217__________________________________________________________________________

It is desirable to make the substitution functions S1 and S2 1-to-1 functions.

The permutation function mixes all the bits in the input to produce the output. For example, the permutation function could be:

__________________________________________________________________________P1 Input  P1 Output__________________________________________________________________________ 0 . . . 15  11    54      27        22          38            32              61                24                  56                    44                      48                        58                          55                            5 21                                3416 . . . 31  52    14      20        36          59            63              49                4 6 18                      39                        35                          43                            19                              50                                232 . . . 47  42    53      23        40          9 1 17                33                  60                    30                      3 51                          26                            12                              45                                6248 . . . 63  29    10      25        41          13            0 31                16                  7 46                      28                        47                          8 57                              15                                37__________________________________________________________________________

In the above example, the value of bit offset 0 in the input is the value of the bit offset 11 in the output.

By this process of substitution and permutation a thorough mixing of the input bits is achieved yet the copyright file cannot be eliminated or substantially reduced as it is needed to determine the calculation.

In an alternate embodiment, the substitution functions could process a subset of the bytes in the accumulator register. For example, the substitution functions could be performed on the first byte only, the first and second bytes only, or any other desired subset of the sixteen bytes. This might be done to improve performance.

In yet another embodiment, only the rightmost 8 bytes of the customer key are loaded in the accumulator register and the substitution functions are performed on a subset of the eight bytes. In this case, the final result is defined as the rightmost eight bytes of the variant customer key and the leftmost eight bytes of the variant customer key are set equal to the leftmost eight bytes of the customer key.

When clear customer keys and encrypted data keys are generated for users, i.e., key distribution is done via the protocol shown in FIG. 1, the 32-bit counter CTR provided as input to the Clear Customer Key Generate service 124 and the Data Key Export service 125 is set to zero (CTR=0). When clear customer keys and encrypted data keys are generated for third party merchants, via the protocol shown in FIG. 2, the 32-bit counter CTR is used as an incrementing counter (CTR=1, CTR=2, etc.).

FIG. 11 is a block diagram illustration of cryptographic subsystem 200. Cryptographic subsystem 200 contains a Data Encryption Algorithm (DEA) 201 capable of performing elementary operations of encryption and decryption, a data key cache 202 for storing decrypted data keys, a set of API-callable services 220 for performing data decryption and key management functions required by the user processor 20, and a set of internal functions 210 which are called by the API services and which eliminate processing redundancies within or maintain consistency across the set of API-callable services. The API-callable services 220 include Customer Key Verify 221, Data Key Verify 222, Data Key Preload 223, and Data Decrypt 224. Those skill in the art will recognize that cryptographic subsystem 200 can contain other API services such as a high-integrity Verification Data Decrypt (VDD) service for validating a data key before it is used for decrypting data. For example, the VDD service could decrypt an encrypted value and check the value for equality with a value-of-reference stored in cryptographic subsystem 200. While such a service enhances the utility of the cryptographic subsystem, it is not a crucial part of the subject invention. The Internal Functions 210 include Set Data Key Error Checking Bits (SDKECB) 212, Set Customer Key Error Checking Bits (SCKECB) 215, and Generate Variant Customer Key (GVCK) 216.

Referring again to FIG. 11, the Customer Key Verify (CKV) function 221 authenticates the error checking bits in an input customer key KC and returns a value indicating that the authentication succeeded (e.g., return code=0) or failed (e.g., return code=8). The process of authenticating the error checking bits in KC consists of the following method steps:

1. Set X:=KC (i.e., make a second copy of KC)

2. Set Y:=128-bit value produced by the SCKECB function 215, using X as the 128-bit input to the function. The SCKECB function 215 in cryptographic subsystem 200 in user processor 20 is the same as the SCKECB function 115 in cryptographic subsystem 100 in software distribution processor 10. See the description of SCKECB function 115.

3. If Y=KC, then set return code:=0 (success) else set return code:=8 (failure).

4. Return the value of return code as a function output.

The Data Key Verify (DKV) function 222 decrypts an encrypted data key of the form e*KC'(KD) using a variant customer key KC' derived from an input customer key KC, authenticates the error checking bits in KD, and returns a value indicating that the authentication succeeded (e.g., return code=0) or failed (e.g., return code=8). The DKV function 222 consists of the following steps:

1. Set KC':=128-bit variant customer key produced by Generate Variant Customer Key (GVCK) function 216, using KC as an input to the function. The GVCK function 216 in cryptographic subsystem 200 in user processor 20 is the same as the GVCK function 116 in cryptographic subsystem 100 in software distribution processor 10. See the description of GVCK function 116.

2. Decrypt e*KC'(KD) with the variant customer key KC' produced in step 1 above. The method of decryption is just the inverse of the method of encryption shown in FIG. 10. That is e*KC'(KD) is decrypted with KCL', the leftmost 64 bits of KC', the result is encrypted with KCR', the rightmost 64 bits of KC', and that result is decrypted with KCL'.

3. Set X:=KD (i.e., make a second copy of KD)

4. Set Y:=64-bit value produced by the SDKECB function 212, using X as the 64-bit input to the function. SDKECB function 212 in cryptographic subsystem 200 is just the same function as SDKECB function 112 in cryptographic subsystem 100. See the description of SDKECB function 112.

5. If Y=KD, then set return code:=0 (success) else set return code:=8 (failure).

6. Return the value of return code as a function output.

The Data Key Preload (DKP) function 223 decrypts an encrypted data key of the form e*KC'(KD) using a variant customer key KC' derived from an input customer key KC, creates a cache record consisting KC, e*KC'(KD), and KD, and stores the cache record in data key cache 202. The DKP function 223 consists of the following steps:

1. Set KC':=128-bit variant customer key produced by Generate Variant Customer Key (GVCK) function 216, using KC as an input to the function. The GVCK function 216 in cryptographic subsystem 200 in user processor 20 is the same as the GVCK function 116 in cryptographic subsystem 100 in software distribution processor 10. See the description of GVCK function 116.

2. Decrypt e*KC'(KD) with the variant customer key KC' produced in step 1 above. The method of decryption is just the inverse of the method of encryption shown in FIG. 10. That is e*KC'(KD) is decrypted with KCL', the leftmost 64 bits of KC', the result is encrypted with KCR', the rightmost 64 bits of KC', and that result is decrypted with KCL'.

3. Set cache record:=concatenation of KC, e*KC'(KD), and KD.

4. Store the so-produced cache record in Data Key Cache 202. The customer key and encrypted data key are used as identifiers to determine whether the corresponding data key KD is stored in Data Key Cache 202. The Data Key Cache 202 is used by the Data Decrypt function 224.

The Data Decrypt (DD) function 224 decrypts encrypted data of the form eKD(0,data), where 0 represents an initial chaining value of 0 (i.e. ICV=X'0000000000000000') and data represents n 64-bit blocks of data, using the Cipher Block Chaining (CBC) mode of DEA decryption. In an actual implementation, a maximum value for n can be established, e.g., the maximum value of n may be 2**32. For example, an upper bound on n may need to be established due to some physical limitation in the implemented cryptographic subsystem. The inputs to DD function 224 are a customer key KC, and encrypted customer key eKC'(KD), and encrypted data eKD(0,data). The output of DD function 224 is the decrypted data. The DD function 224 consists of the following steps:

1. Using KC and eKC'(KD) as identifiers, search the Data Key Cache 202 for a cache record containing KC, eKC'(KD), and KD. If a cache record is found, extract KD from the recovered cache record and jump to step 4, else continue (i.e., decrypt the encrypted KD)

2. Set KC':=128-bit variant customer key produced by Generate Variant Customer Key (GVCK) function 216, using KC as an input to the function. The GVCK function 216 in cryptographic subsystem 200 in user processor 20 is the same as the GVCK function 116 in cryptographic subsystem 100 in software distribution processor 10. See the description of GVCK function 116.

3. Decrypt e*KC'(KD) with the variant customer key KC' produced in step 2 above. The method of decryption is just the inverse of the method of encryption shown in FIG. 10. That is e*KC'(KD) is decrypted with KCL', the leftmost 64 bits of KC', the result is encrypted with KCR', the rightmost 64 bits of KC', and that result is decrypted with KCL'.

4. Set data:=plaintext recovered when eKD(0,data) is decrypted with KD (obtained at step 1 or step 3) and initial chaining value=0 using the CBC mode of DEA decryption.

5. Return data as a function output.

FIG. 12 is a block diagram illustration of the sequence of API-callable services that must be performed to accomplish software distribution from software distribution center 10 to user processor 20. Referring to FIG. 12, at software distribution processor 10, a Data Key Generate service 122 is invoked at step 300 to generate a 64-byte data key record (KD-record) containing an encrypted data key. Step 300 can be repeated as many times as necessary to produce unique KD-records for each multimedia file or group of files to be sold and licensed as a unit. At step 301, the n 64-bit blocks of data and the so-produced 64-byte KD-record are provided as inputs to an Encrypt With Verify service 123, which produces n 64-bit blocks of encrypted data, eKD(0,data). The expression eKD(0,data) indicates that the input data, designated here as "data", is encrypted with key KD and an initial chaining value of zero using CBC mode of DEA encryption. At step 302, a 1 to 80 character passphrase is input to a Clear Key-Generating Key Install service 121, which produces a 64 -byte key-generating key record (KGK-record) containing a 128-bit encrypted key-generating key. Step 302 can be repeated as many times as necessary to produce unique KGK-records needed by the key management system for providing cryptographic separation among the generated customer keys. At step 303, the so-produced KGK-record, a 10 decimal digit customer number, and a 32-bit counter are input to a Clear Customer Key Generate service 124, which produces a 128-bit customer key KC. At step 304, one of the plurality of KGK-records produced at step 302, a 10 decimal digit customer number, a 32-bit counter, and one of plurality of KD-records produced at step 300 are input to a Data Key Export service 125, which produces an encrypted data key of the form e*KC'(KD). The expression e*KC'(KD) indicates that 64-bit data key KD is encrypted with 128-bit variant customer key KC'. The customer key KC, the encrypted data key e*KC'(KD), and the encrypted data eKD(0,data) are transmitted from the software distribution processor 10 to the user processor 20. The customer key and encrypted data key are transmitted via key distribution medium 31 and the encrypted data is transmitted via encrypted file distribution medium 30, as illustrated in FIG. 3. At user processor 20, the received customer key KC is input at step 310 to a Customer Key Verify service 221, which causes the error checking bits in the customer key to be authenticated. If the error checking bits are correct, the Customer Key Verify service 221 returns a success (return code=0) in which case the customer key KC is stored in a key library for subsequent use. If the error checking bits are incorrect, the Customer Key Verify service 221 returns a failure (return code=8) in which case the customer key is rejected. If the customer key fails to authenticate properly, an error recovery procedure (not shown in FIG. 12) is executed. Those skilled in the art will recognize that there are many possible methods and protocols for error recovery including sending a message to the software distribution process 10 and requesting that the customer key be re-transmitted. The error recovery step is not essential to the working of the subject invention, but would be a necessary part of an actual implementation of the subject invention. It shall be assumed here that the error checking bits in the customer key KC authenticate properly. At step 311, the authenticated KC and the received, associated encrypted data key, e*KC'(KD), are input to a Data Key Verify service 222, which causes the error checking bits in the data key KD to be authenticated. Of course, this requires that the encrypted data key first be decrypted under the variant customer key KC', which is produced from the received so-authenticated input customer key KC. If the error checking bits are correct, the Data Key Verify service 222 returns a success (return code=0) in which case the encrypted data key, e*KC'(KD), is stored in a key library for subsequent use. If the error checking bits are incorrect, the Data Key Verify service 222 returns a failure (return code=8) in which case the encrypted data key, e*KC'(KD), is rejected and not stored in the key library. If the encrypted data key fails to authenticate properly, an error recovery procedure (not shown in FIG. 12) is executed. Those skilled in the art will recognize that there are many possible methods and protocols for error recovery including sending a message to the software distribution process 10 and requesting that the encrypted data key be re-transmitted. The error recovery step is not essential to the working of the subject invention, but would be a necessary part of an actual implementation of the subject invention. It shall be assumed here that the error checking bits in the data key KD authenticate properly. Those skilled in the art will also recognize that there are many ways in which a key library can be implemented, and that this aspect of the key management does not affect the working of the subject invention. However, when a customer key KC and an associated encrypted data key e*KC'(KD) are stored in the key library, a link must be provided from the encrypted data key to the corresponding customer key to be used in decrypting the encrypted data key. This can be accomplished in many different ways including the simple approach of storing KC and e*KC'(KD) as a key pair in a single record. However, this has the disadvantage that the same KC is stored many times in the key library. Storing customer keys a separate sub-library and providing a link or pointer from the encrypted data key to its associated customer key is more economical in terms of required storage space, especially if many keys are stored in the key library. At step 312, the so-authenticated encrypted data key e*KC'(KD) and its so-associated, so-authenticated customer key KC are input to a Data Key Preload service 213, which (1) decrypts e*KC'(KD) with a variant customer key KC' produced from the input KC, (2) produces a cache record consisting of the concatenation of KC, e*KC'(KD), and KD, and (3) stores the cache record in Data Key Cache 214 shown in FIG. 11. At step 313, the so-authenticated e*KC'(KD), the so-associated and so-authenticated KC, and the so-associated, so-received n 64-bit blocks of encrypted data, designated eKD(0,data), are input to a Data Decrypt service 224, which produces n 64-bit blocks of decrypted data. The data key KD used for decrypting eKD(0,data) is recovered either from Data Key Cache 214 or by decrypting e*KC'(KD) with a KC' produced from the input KC.

FIG. 13 is a block diagram illustration of the process for producing a customer key with the Generate Customer Key (GCK) internal function 113 available in cryptographic subsystem 100 of software distribution processor 10, as shown in FIG. 4. At step 320, a 10 decimal digit customer number, a 32-bit counter CTR, and a 128-bit key-generating key KGK are input to a Generate Derived Part internal function 114, which produces a 64-bit Derived Part. The so-produced Derived Part is stored as the rightmost 64 bits of intermediate key 340. The 10 decimal digit customer number is also input to Convert function 330 which converts each decimal digit to a 4-bit "nibble" (i.e., 0=B'0000', 1=B'0001', 2=B'0010', etc.), concatenates the 10 "nibbles" to form a 40-bit value CN, and stores the 40-bit CN as the leftmost 40 bits of intermediate key 340. Bits 40 thru 47 of intermediate key 340 are set to a constant X'FF'; bits 48 thru 63 of intermediate key 340 are not initialized, since they are later initialized by a Set Customer Key Error Checking Bits internal function 115. (The bits of the intermediate key 340 are numbered 0, 1, . . . , 127, from most significant to least significant.) The so-produced intermediate key 340 is input to a Set Customer Key Error Checking Bits (SCKECB) internal function 115, which produces customer key 350. The distinction between intermediate key 340 and customer key 350 is that in intermediate key 340 the 24 error checking bits are not initialized and in customer key 350 they are initialized. The error checking bits are located in bit positions 48 thru 63, inclusive, 71, 79, 87, 95, 103, 119 and 127 of customer key 350. The reader will also see from FIG. 13 that customer key 350 contains a clear customer number. Thus, when a customer key is transmitted via key distribution medium 31 or when a customer key is stored in a key library at user processor 20, the customer number -- which is a sub-field of the customer key -- appears in clear form so that it may be audited and used as a means to trace the key back to the original user to which the key was issued. Moreover, when the customer key is transmitted via key distribution medium 31, it is first translated from 16 characters (i.e., a 128-bit value) to 32 hexadecimal-coded native characters (e.g., ASCII characters) so that each decimal digit in the customer key will be represented as a single character. Thus, if the customer key is printed on a piece of paper, the customer number is plainly visible within the customer key. This especially true since the customer number is positioned as the first field in the customer key and is immediately followed by the constant "FF". For example, a customer key might appear in printed form as 0009735124FF3A02D52AB99128C8F634 so that the customer number is 0009735124.

FIG. 14 is a block diagram illustration of software distribution from a software distribution processor 10 to a user processor 20. At software distribution processor 10, a plurality of files (FILE1, FILE2, FILEmax) including an ith file, FILEi, are encrypted via encryption means 400 with a corresponding plurality of file encryption keys (KD1, KD2, . . . , KDmax) including an ith file encryption key, KDi, to produce a plurality of encrypted files (eKD1(FILE1), eKD2(FILE2), . . . , eKDmax(FILEmax)) including an ith encrypted file eKDi(FILEi). A subset of the plurality of so-produced encrypted files is transmitted via encrypted file distribution medium 30 from software distribution processor 10 to user processor 20. In response to a customer order for software, say for FILEi, a first customer key KC1 350 is produced. Next, the so-produced customer key is input to transformation function f 355 to produce a second customer key KC2 351. Transformation function f 355 is just the Generate Variant Customer Key (GVCK) internal function 116 of FIG. 4. First customer key KC1 350 is just the same customer key 350 of FIG. 13. Second customer key KC2 351 is just the variant customer key which is produced from a customer key using the GVCK internal function 116. The so-produced second customer key KC2 351 and the ith data key KDi are input to an encryption means 352 to produce an encrypted data key e*KC2(KDi). The process of producing second customer key KC2 351 with transformation function f 355, and of encrypting KDi with KC2 via encryption means 352, is primarily the function performed by the Data Key Export service 125 of FIG. 4. The so-produced first customer key KC1 and the so-produced encrypted ith file encryption key eKC2(DKi) are transmitted via key distribution medium 31 from software distribution processor 10 to user processor 20. At user processor 20, received first customer key KC1 350 is input to a like transformation function f 355 which produces second customer key KC2 351. The so-produced second customer key KC2 351 and the received ith encrypted file key eKC2(KDi) are input to a decryption means 353, which decrypts eKC2(KDi) with KC2 to produce a clear value of KDi. The so-produced ith file key KDi and the received ith encrypted file eKDi(FILEi) are input to a decryption means 354, which decrypts FILEi. FILEi is returned as an output to user processor 20. The process of producing KC2 from KC1 with transformation function f 355 and the process of decrypting eKC2(KDi) with KC2 are just the operations performed by Data Key Preload service 223 of FIG. 11.

Third Party Merchant: The method of software distribution from a software vendor to a user can is easily adapted to the situation where software is distributed from a software vendor to a third party merchant and thence from the third party merchant to a user. The concept of such a method of software distribution is illustrated in FIG. 2.

When a third party merchant contacts the software vendor (say IBM) and requests to buy software on CD-ROMs, the software vendor supplies the third party merchant packages with a CD-ROM and pregenerated keys. Suppose that the merchant want to place an order for quantities of software as shown in FIG. 15, i.e., 200 OS/2 2.0, 100 OS/2 2.0 Extended Services, 500 WordPerfect for OS/2, 50 Program A, 100 Program B. Assume that all of the software programs are packaged on one CD-ROM and all are protected using the method of encryption described by the subject invention. In this case, the software distribution processor 10 would generate 200 keys for OS/2, printing them on a pre-numbered sheet of paper or special form with the following characteristics. Each sheet of paper would be of the type that has a window with an address of the dealer that can be read from the outside but the key is readable only after you "open" the form. The software vendor would seal a CD-ROM and a key sheet, along with the license information and other papers in a shrink wrapped package.

The production of a customer key is different depending on whether the key is distributed directly to a user or whether it is distributed first to a merchant and then to a user. In situations where customer keys are generated for users, the 32-bit counter CTR provided as an input to the Clear Customer Key Generate service 124 and to the Data Key Export service 125 is set to zero. However, where customer keys are generated for merchants, the 32-counter CTR provided as an input to the Clear Customer Key Generate service 124 and to the Data Key Export service 125 starts with value 1 and is incremented by one for each key. This permits many different customer keys to be generated and distributed to the same merchant who has a single customer number. The counter would be incremented one for each key so each customer key would be different, and thus the encrypted data key e*KC'(KD) would be different for each software program in each shrink wrapped package. The software program that the keys unlock would be clearly identified on the outside wrapping of the package.

The same procedure would be used to produce the keys for each different software program, or product, such as OS/2 ES. The software distribution processor would generate 100 sets of keys (customer key and encrypted data key), using the counter set at the last value, in this case 200). These keys would be packaged with a CD-ROM and clearly marked with the ES product indentification. The remaining products would be packaged in the same way. The dealer would receive 950 CD-ROMs with 950 sets of keys. All packages would be 81/2 by 11 inches, shrink wrapped. Each package would have a pre-printed number on it, like the red numbers printed on the edge of computer forms.

When a customer comes into the merchant's store and asks to purchase OS/2, the dealer sell him one of the OS/2 packages. The dealer may or may not elect to record the pre-printed number as being sold to that customer. If the customer gets back to his business and finds out that he needs the ES features, there are several options for getting this extra needed software. The customer could call the merchant, who in turn could open another shrink wrapped package and give the customer the key set for ES over the phone. Alternatively, the customer could come into the store and pick up the key set. The customer could go to another dealer and purchase ES. The entire transaction, at that point, is between the dealer and the customer. It is not necessary that software vendor be involved other than perhaps providing a way to verify and replace "lost" keys. However, there is nothing to prevent a customer from calling the software vendor directly and getting a key set issued over the telephone.

The key management approach eliminates the need for a dealer to have key generation equipment. This also simplifies the accounts payable interaction between the software vendor and merchants (dealers) The merchant buys the inventory they want and pays for that inventory. The software vendor could have some provision for returning unopened packages to handle the unsold inventory issue. In this scheme, the software vendor treats the dealer as a customer.

FIG. 16 is an illustration of a shrink wrapped package 500 containing a stamped medium 501 (e.g., a CD-ROM) containing (1) an ith encrypted file eKDi(file i) 503, i.e., file i encrypted with ith file encryption key KDi and (2) a piece of paper 502 on which is printed a clear customer key KC 504 and an encrypted ith file key e*KC'(KDi) 505, where KC' is the variant customer key produced from KC 505. As mentioned, the piece of paper 502 on which the keys are printed is such that the keys cannot be seen except by opening the shrink wrapped package 500 (which in effect means that the package has been purchased). KC 504 is written as 32 hexadecimal-coded characters (e.g., ASCII) and e*KC'(KDi) 505 is written as 16 hexadecimal-coded characters (e.g., ASCII). When a user purchases a shrink wrapped package 500 of software, say OS/2, from the merchant, the keys (customer key 504 and encrypted data key 505) must be entered manually at user processor 20. Once initialized at user processor 20, key processing and file recovery proceeds in the same way as for the case of software distribution from a software vendor to a user. In effect, the only procedural difference is that when a merchant is involved in the key and file distribution process, keys are received by a user over a key distribution medium 31 from a third party merchant 15 rather than from a software distribution processor 10. Likewise, the encrypted file is received over an encrypted file distribution medium 30 from a third party merchant 15 rather than from a software distribution processor 10. The fact that the customer keys provided to a third part merchant are produced with an incrementing counter CTR rather than a counter value of zero (CTR=0) is transparent to the key and file recovery processes carried out at user processor 20.

Although a specific embodiment of the invention has been disclosed, it will be understood by those having skill in the art that changes can be made to that specific embodiment without departing from the spirit and the scope of the invention.

Patent Citations
Cited PatentFiling datePublication dateApplicantTitle
US4168396 *31 Oct 197718 Sep 1979Best Robert MMicroprocessor for executing enciphered programs
US4278837 *4 Jun 197914 Jul 1981Best Robert MCrypto microprocessor for executing enciphered programs
US4433207 *10 Sep 198121 Feb 1984Best Robert MCryptographic decoder for computer programs
US4446519 *26 May 19811 May 1984Corban International, Ltd.Method and apparatus for providing security for computer software
US4658093 *11 Jul 198314 Apr 1987Hellman Martin ESoftware distribution system
US4757534 *3 Feb 198712 Jul 1988International Business Machines CorporationCode protection using cryptography
US4937863 *7 Mar 198826 Jun 1990Digital Equipment CorporationSoftware licensing management system
US4999806 *4 Sep 198712 Mar 1991Fred ChernowSoftware distribution system
Referenced by
Citing PatentFiling datePublication dateApplicantTitle
US5394469 *18 Feb 199428 Feb 1995Infosafe Systems, Inc.Method and apparatus for retrieving secure information from mass storage media
US5416840 *6 Jul 199316 May 1995Phoenix Technologies, Ltd.Software catalog encoding method and system
US5420925 *3 Mar 199430 May 1995Lectron Products, Inc.Rolling code encryption process for remote keyless entry system
US5428685 *21 Jan 199327 Jun 1995Fujitsu LimitedIC memory card and method of protecting data therein
US5490216 *21 Sep 19936 Feb 1996Uniloc Private LimitedSystem for software registration
US5509070 *15 Dec 199216 Apr 1996Softlock Services Inc.Method for encouraging purchase of executable and non-executable software
US5530752 *22 Feb 199425 Jun 1996Convex Computer CorporationSystems and methods for protecting software from unlicensed copying and use
US5553143 *4 Feb 19943 Sep 1996Novell, Inc.Method and apparatus for electronic licensing
US5557518 *28 Apr 199417 Sep 1996Citibank, N.A.Trusted agents for open electronic commerce
US5586186 *15 Jul 199417 Dec 1996Microsoft CorporationMethod and system for controlling unauthorized access to information distributed to users
US5621797 *19 Dec 199515 Apr 1997Citibank, N.A.Electronic ticket presentation and transfer method
US5625690 *15 Nov 199329 Apr 1997Lucent Technologies Inc.Software pay per use system
US5642419 *19 Dec 199524 Jun 1997Citibank N.A.Method for acquiring and revalidating an electronic credential
US5646992 *23 Sep 19938 Jul 1997Digital Delivery, Inc.Assembly, distribution, and use of digital information
US5666412 *20 Jan 19959 Sep 1997News Datacom Ltd.Secure access systems and methods utilizing two access cards
US5671280 *30 Aug 199523 Sep 1997Citibank, N.A.System and method for commercial payments using trusted agents
US5673315 *24 Jul 199530 Sep 1997International Business Machines CorporationMethod and system for software asset usage detection and management
US5673316 *29 Mar 199630 Sep 1997International Business Machines CorporationCreation and distribution of cryptographic envelope
US5689561 *6 Oct 199518 Nov 1997Pace; MichaelComputer-based trading card system and method
US5694469 *17 Nov 19952 Dec 1997Le Rue; CharlesMethod and system for disseminating stored programs and data
US5694470 *10 Nov 19942 Dec 1997Telub Teknik AbSystem for reading encrypted information, and unit for use in such a system
US5703949 *23 Oct 199630 Dec 1997Citibank, N.A.Method for establishing secure communications among processing devices
US5719938 *1 Aug 199417 Feb 1998Lucent Technologies Inc.Methods for providing secure access to shared information
US5727065 *2 Jun 199710 Mar 1998Hughes ElectronicsDeferred billing, broadcast, electronic document distribution system and method
US5737415 *31 Jul 19957 Apr 1998Fujitsu LimitedData management module, data reproduction management device and data reproduction management system
US5740247 *22 Dec 199514 Apr 1998Pitney Bowes Inc.Authorized cellular telephone communication payment refill system
US5745678 *18 Aug 199728 Apr 1998International Business Machines CorporationMethod and system for the secured distribution of multimedia titles
US5745886 *7 Jun 199528 Apr 1998Citibank, N.A.Trusted agents for open distribution of electronic money
US5754761 *29 Aug 199719 May 1998Willsey; John A.Universal sofeware key process
US5757417 *23 Sep 199726 May 1998International Business Machines CorporationMethod and apparatus for screening audio-visual materials presented to a subscriber
US5758068 *19 Sep 199526 May 1998International Business Machines CorporationMethod and apparatus for software license management
US5758069 *15 Mar 199626 May 1998Novell, Inc.Electronic licensing system
US5765106 *22 Dec 19959 Jun 1998Pitney Bowes Inc.Authorized cellular telephone communication access and verification control system
US5768383 *22 Dec 199516 Jun 1998Pitney Bowes Inc.Authorized cellular voice messaging and/or analog or digital data communication access and verification control system
US5774544 *28 Mar 199630 Jun 1998Advanced Micro Devices, Inc.Method an apparatus for encrypting and decrypting microprocessor serial numbers
US5774546 *8 Jan 199730 Jun 1998News Datacom Ltd.Secure access system utilizing an access card having more than one embedded integrated circuit and/or plurality of security levels
US5774651 *28 May 199630 Jun 1998Fujitsu LimitedFalse statement detection system
US5784460 *10 Oct 199621 Jul 1998Protocall Technolgies, Inc.Secured electronic information delivery system having a three-tier structure
US5787169 *28 Dec 199528 Jul 1998International Business Machines Corp.Method and apparatus for controlling access to encrypted data files in a computer system
US5787175 *23 Oct 199528 Jul 1998Novell, Inc.Method and apparatus for collaborative document control
US5790663 *28 Mar 19964 Aug 1998Advanced Micro Devices, Inc.Method and apparatus for software access to a microprocessor serial number
US5790783 *28 Mar 19964 Aug 1998Advanced Micro Devices, Inc.Method and apparatus for upgrading the software lock of microprocessor
US5809145 *28 Jun 199615 Sep 1998Paradata Systems Inc.System for distributing digital information
US5809545 *12 Sep 199515 Sep 1998Victor Company Of Japan, Ltd.Optical disc for a master key, and a method and apparatus for optical-disc information management which inhibit and permit reproduction of main information from an illegal copy disc by using physical and logical security information
US5812945 *22 Dec 199522 Sep 1998Pitney Bowes Inc.Metered payment cellular telephone communication system
US5818933 *5 Jul 19966 Oct 1998Mitsubishi Denki Kabushiki KaishaCopyright control system
US5845281 *31 Jan 19961 Dec 1998Mediadna, Inc.Method and system for managing a data object so as to comply with predetermined conditions for usage
US5852664 *10 Jul 199522 Dec 1998Intel CorporationDecode access control for encoded multimedia signals
US5857021 *10 Oct 19965 Jan 1999Fujitsu Ltd.Security system for protecting information stored in portable storage media
US5878134 *8 Sep 19972 Mar 1999News Data Com Ltd.Secure access systems utilizing more than one IC card
US5878139 *16 Oct 19962 Mar 1999Citibank, N.A.Method for electronic merchandise dispute resolution
US5878141 *25 Aug 19952 Mar 1999Microsoft CorporationComputerized purchasing system and method for mediating purchase transactions over an interactive network
US5884158 *15 Oct 199616 Mar 1999Pitney Bowes Inc.Cellular telephone authentication system using a digital certificate
US5892825 *25 Nov 19966 Apr 1999Hyperlock Technologies IncMethod of secure server control of local media via a trigger through a network for instant local access of encrypted data on local media
US5903650 *3 May 199611 May 1999Novell IncMethod and apparatus for electronic license distribution
US5903896 *15 Jul 199711 May 1999Microsoft CorporationMethod for installing a file on demand using a preview
US5905860 *24 Feb 199718 May 1999Novell, Inc.Fault tolerant electronic licensing system
US5923754 *2 May 199713 Jul 1999Compaq Computer CorporationCopy protection for recorded media
US5933498 *5 Nov 19973 Aug 1999Mrj, Inc.System for controlling access and distribution of digital property
US5933620 *28 Mar 19963 Aug 1999Advanced Micro Devices, Inc.Method and apparatus for serializing microprocessor identification numbers
US5935004 *28 Aug 199510 Aug 1999Mediaone Group, Inc.System and method for scheduled delivery of a software program over a cable network
US5935243 *1 Jul 199610 Aug 1999Fujitsu Ltd.Licensee notification system
US5949876 *8 Jan 19977 Sep 1999Intertrust Technologies CorporationSystems and methods for secure transaction management and electronic rights protection
US5968129 *21 May 199819 Oct 1999Hughes Electronics CorporationMethod and apparatus for selectively retrieving information from a source computer using a terrestrial or satellite interface
US5974307 *21 Dec 199526 Oct 1999Pitney Bowes Inc.Method and system communicating with a voice response unit over a cellular telephone network
US5978482 *21 Aug 19952 Nov 1999International Business Machines CorporationMethod and system for protection of digital information
US5995725 *28 Jul 199730 Nov 1999Hughes Electronics CorporationMethod and apparatus for requesting and retrieving information from a source computer using terrestrial and satellite interfaces
US5995726 *24 Feb 199730 Nov 1999Hughes Electronics CorporationMethod and apparatus for requesting and retrieving information from a source computer using terrestrial and satellite interfaces
US6006228 *11 Dec 199621 Dec 1999Ncr CorporationAssigning security levels to particular documents on a document by document basis in a database
US6016388 *6 May 199818 Jan 2000Hughes Electronics CorporationMethod and apparatus for requesting and retrieving information from a source computer using terrestrial and satellite interfaces
US6023506 *28 Oct 19968 Feb 2000Hitachi, Ltd.Data encryption control apparatus and method
US6035043 *22 Dec 19957 Mar 2000Pitney Bowes Inc.Cellular telephone manifest system
US6038316 *24 Sep 199714 Mar 2000International Business Machines CorporationMethod and system for protection of digital information
US6061656 *17 Nov 19979 May 2000Pace; MichaelComputer-based trading card system and method
US6069952 *29 Sep 199530 May 2000Mitsubishi CorporationData copyright management system
US6075862 *30 Jul 199613 Jun 2000Kabushiki Kaisha ToshibaDecryption key management scheme for software distribution system
US6088797 *21 Aug 199811 Jul 2000Rosen; Sholom S.Tamper-proof electronic processing device
US6097818 *3 Jul 19971 Aug 2000Mitsubishi CorporationData copyright management method
US6115750 *18 Dec 19985 Sep 2000Hughes Electronics CorporationMethod and apparatus for selectively retrieving information from a source computer using a terrestrial or satellite interface
US6125184 *23 May 199726 Sep 2000Hughes Electronics CorporationMethod and apparatus for an adapter card providing conditional access in a communication system
US6131160 *9 Apr 199910 Oct 2000Hughes Electronics CorporationMethod and apparatus for an adapter card providing conditional access in a communication system
US6134324 *29 May 199717 Oct 2000Lsi Logic CorporationMethod and system for distributing a plurality of software products, and limiting access thereto
US6134593 *30 Sep 199717 Oct 2000Cccomplete, Inc.Automated method for electronic software distribution
US6148342 *13 Jan 199914 Nov 2000Ho; Andrew P.Secure database management system for confidential records using separately encrypted identifier and access request
US6161141 *3 Dec 199812 Dec 2000Hughes Electronics CorporationNetwork system with TCP/IP protocol spoofing
US6173403 *8 Apr 19999 Jan 2001Achates Reference Publishing, Inc.Method and apparatus for distributing information products
US617592116 Jul 199716 Jan 2001Citibank, N.A.Tamper-proof devices for unique identification
US617824327 Feb 199823 Jan 2001Aliroo LtdUser-controlled document processing
US617850826 Feb 199823 Jan 2001International Business Machines Corp.System for controlling access to encrypted data files by a plurality of users
US618530610 Jun 19976 Feb 2001Hyperlock Technologies, Inc.Method of secure server control of local media via a trigger through a network for local access of encrypted data on an internet webpage
US6212280 *21 Oct 19993 Apr 2001L3-Communications CorporationApparatus and methods for managing key material in heterogeneous cryptographic assets
US62158733 Apr 200010 Apr 2001Hughes Electronics CorporationAdapter for connecting computer to satellite antenna
US622328822 May 199824 Apr 2001Protexis Inc.System for persistently encrypting critical software file to prevent installation of software program on unauthorized computers
US622661813 Aug 19981 May 2001International Business Machines CorporationElectronic content delivery system
US6226678 *25 Sep 19961 May 2001Netspeak CorporationMethod and apparatus for dynamically defining data communication utilities
US6237020 *30 Sep 199722 May 2001International Business Machines CorporationTask-oriented automatic distribution of software
US623829020 May 199929 May 2001Mediaone Group, Inc.System and method for scheduled delivery of a software program over a cable network
US624986616 Sep 199719 Jun 2001Microsoft CorporationEncrypting file system and method
US626331330 Nov 199817 Jul 2001International Business Machines CorporationMethod and apparatus to create encoded digital content
US6266416 *10 Jul 199624 Jul 2001Sigbjoernsen SigurdProtection of software against use without permit
US626884530 Jun 199731 Jul 2001Compaq Computer CorporationBezel button controls over USB
US627263510 Apr 20007 Aug 2001Mitsubishi CorporationData copyright management system
US62791144 Nov 199821 Aug 2001Sandisk CorporationVoltage negotiation in a single host multiple cards system
US6289466 *30 Jun 199711 Sep 2001Compaq Computer CorporationUsage of monitor bezel buttons to control and indicate multimedia functions
US629844114 Jul 19982 Oct 2001News Datacom Ltd.Secure document access system
US63079371 May 200023 Oct 2001Hughes Electronics CorporationMethod and apparatus for an adapter card providing conditional access in a communication system
US6308269 *7 Jul 199823 Oct 2001U.S. Philips CorporationArrangement for independently requesting a playing authorization for a reproduced encrypted information signal
US631440926 Oct 19986 Nov 2001Veridian Information SolutionsSystem for controlling access and distribution of digital property
US632126824 Feb 200020 Nov 2001Hughes Electronics CorporationMethod and apparatus for selectively retrieving information from a source computer using a terrestrial or satellite interface
US633197925 Sep 200018 Dec 2001Hughes Electronics CorporationMethod and apparatus for connecting computer to satellite antenna
US633609520 Nov 19981 Jan 2002Citibank, N.A.Method for electronic merchandise dispute resolution
US6337911 *9 Mar 19988 Jan 2002Hughes Electronics CorporationDeferred billing, broadcast, electronic document distribution system and method
US63381311 May 20008 Jan 2002Hughes Electronics CorporationNetwork system with TCP/IP ACK reduction
US63452561 Dec 19985 Feb 2002International Business Machines CorporationAutomated method and apparatus to package digital content for electronic distribution using the identity of the source content
US6347145 *26 Jun 199712 Feb 2002Kabushiki Kaisha ToshibaMethod and apparatus of enciphering and deciphering data using keys enciphered and deciphered with other keys
US6347846 *11 Dec 199619 Feb 2002Kabushiki Kaisha ToshibaMethod and an apparatus to control copying from a data providing device to a data receiving device
US637394713 Oct 200016 Apr 2002Aliroo Ltd.Document processing
US638940317 Sep 199914 May 2002International Business Machines CorporationMethod and apparatus for uniquely identifying a customer purchase in an electronic distribution system
US638953822 Oct 199814 May 2002International Business Machines CorporationSystem for tracking end-user electronic content usage
US6389541 *15 May 199814 May 2002First Union National BankRegulating access to digital content
US63982451 Dec 19984 Jun 2002International Business Machines CorporationKey management system for digital content player
US640536923 Jan 199711 Jun 2002News Datacom LimitedSmart card chaining in pay television systems
US6408390 *16 Aug 199918 Jun 2002Mitsubishi CorporationApparatus for data copyright management system
US641842110 Dec 19989 Jul 2002International Business Machines CorporationMultimedia player for an electronic content delivery system
US6430292 *6 Jul 19986 Aug 2002Hitachi, Ltd.System and method for controlling disclosure time of information
US643453513 Nov 199813 Aug 2002Iomega CorporationSystem for prepayment of electronic content using removable media and for prevention of unauthorized copying of same
US643823214 Jul 200020 Aug 2002John Ga 1T Media, Inc.Method of securing the playback of a DVD-ROM via triggering data sent via a cable network
US6438233 *4 Aug 199720 Aug 2002Nippon Telegraph And Telephone CorporationBook data service system with data delivery by broadcasting
US6438235 *5 Aug 199820 Aug 2002Hewlett-Packard CompanyMedia content protection utilizing public key cryptography
US644269021 Oct 199927 Aug 2002L3-Communications CorporationApparatus and methods for managing key material in heterogeneous cryptographic assets
US64497173 Jan 200010 Sep 2002Mitsubishi CorporationData copyright management system
US6453300 *19 Aug 199917 Sep 2002Cd Coupon, LlcPersonalized greeting card with electronic storage media and method of personalizing same
US6460023 *16 Jun 19991 Oct 2002Pulse Entertainment, Inc.Software authorization system and method
US6460137 *19 Mar 19961 Oct 2002Fujitsu LimitedEncryption processing system
US646014030 Dec 19991 Oct 2002Starnet Communications CorporationSystem for controlling the use of licensed software
US64635365 Jun 20018 Oct 2002Mitsubishi CorporationData copyright management system
US6470085 *21 Aug 199722 Oct 2002Matsushita Electric Industrial Co., Ltd.Application package and system for permitting a user to use distributed application package on the term of the use thereof
US6483512 *1 Aug 200019 Nov 2002Micron Technology, Inc.Animation packager for an on-line book
US6487293 *14 Sep 199826 Nov 2002Sony CorporationMethod and apparatus for reproducing ciphered data
US651051615 Jan 199921 Jan 2003Macrovision CorporationSystem and method for authenticating peer components
US651965128 Nov 200011 Feb 2003Hughes Electronics CorporationApparatus and method for hybrid network access
US6523117 *5 Jul 199618 Feb 2003Fujitsu LimitedSystem and method of online deciphering data on storage medium
US657460914 Sep 19983 Jun 2003International Business Machines CorporationSecure electronic content management system
US6577734 *31 Oct 199510 Jun 2003Lucent Technologies Inc.Data encryption key management system
US65878371 Dec 19981 Jul 2003International Business Machines CorporationMethod for delivering electronic content from an online store
US660645021 May 199912 Aug 2003Ati International SrlMethod and apparatus for processing video signals having associated access restriction data
US661181217 Aug 199926 Aug 2003International Business Machines CorporationSecure electronic content distribution on CDS and DVDs
US66614191 Nov 20029 Dec 2003Micron Technology, Inc.Animation packager for an on-line book
US667174128 Nov 200030 Dec 2003Hughes Electronics Corp.Apparatus and method for hybrid network access
US6687375 *2 Jun 19993 Feb 2004International Business Machines CorporationGenerating user-dependent keys and random numbers
US670137019 Jun 20002 Mar 2004Hughes Electronics CorporationNetwork system with TCP/IP protocol spoofing
US67081577 Feb 200116 Mar 2004Contentguard Holdings Inc.System for controlling the distribution and use of digital works using digital tickets
US67149217 Feb 200130 Mar 2004Contentguard, Inc.System for controlling the distribution and use of digital works using digital tickets
US672188723 May 200213 Apr 2004Mitsubishi CorporationData copyright management system
US672530331 Aug 200020 Apr 2004At&T Corp.Method and apparatus for establishing a personalized connection with a network
US6728878 *6 Aug 200127 Apr 2004Hughes Electronics CorporationDeferred billing, broadcast, electronic document distribution system and method
US673531114 Apr 199711 May 2004Fraunhofer-Gellschaft Zur Forderung Der Angewandten Forschung E.V.Encryption and decryption of multi-media data
US67419912 Nov 200125 May 2004Mitsubishi CorporationData management system
US674202815 Sep 200025 May 2004Frank WangContent management and sharing
US6742120 *15 Dec 199825 May 2004Mondex International LimitedSystem and method for controlling access to computer code in an IC card
US675464231 May 200122 Jun 2004Contentguard Holdings, Inc.Method and apparatus for dynamically assigning usage rights to digital works
US677234015 Mar 20003 Aug 2004Microsoft CorporationDigital rights management system operating on computing device and having black box tied to computing device
US677565524 Nov 199910 Aug 2004Microsoft CorporationRendering digital content in an encrypted rights-protected form
US67891972 Oct 20007 Sep 2004Mitsubishi CorporationApparatus for data copyright management system
US680200622 Jul 19995 Oct 2004Macrovision CorporationSystem and method of verifying the authenticity of dynamically connectable executable images
US680753431 May 200019 Oct 2004Trustees Of Dartmouth CollegeSystem and method for managing copyrighted electronic media
US681659615 Mar 20009 Nov 2004Microsoft CorporationEncrypting a digital object based on a key ID selected therefor
US68240517 Jun 200230 Nov 2004Contentguard Holdings, Inc.Protected content distribution system
US682970815 Mar 20007 Dec 2004Microsoft CorporationSpecifying security for an element by assigning a scaled value representative of the relative security thereof
US68341109 Dec 199921 Dec 2004International Business Machines CorporationMulti-tier digital TV programming for content distribution
US6834346 *30 Jul 199921 Dec 2004Sony CorporationContent processing system
US683977026 Apr 20004 Jan 2005Hughes Electronics CorporationApparatus and method for access to network via satellite
US6839842 *27 Dec 19964 Jan 2005Intel CorporationMethod and apparatus for authenticating information
US684252122 Jan 200211 Jan 2005Kabushiki Kaisha ToshibaMethod and apparatus to control copying from a drive device to a data reproducing device
US685406115 Oct 20028 Feb 2005International Business Machines CorporationInstalling and controlling trial software
US6857071 *29 Jul 199915 Feb 2005Nec CorporationSystem and method for distributing digital works, apparatus and method for reproducing digital works, and computer program product
US685953321 Dec 199922 Feb 2005Contentguard Holdings, Inc.System and method for transferring the right to decode messages in a symmetric encoding scheme
US686555131 Mar 20038 Mar 2005Contentguard Holdings, Inc.Removable content repositories
US68684979 Mar 200015 Mar 2005Digimarc CorporationMethod and apparatus for automatic ID management
US687698431 May 20015 Apr 2005Contentguard Holdings, Inc.Method and apparatus for establishing usage rights for digital content to be created in the future
US688574824 Mar 200026 Apr 2005Contentguard Holdings, Inc.System and method for protection of digital works
US688609812 Aug 200026 Apr 2005Microsoft CorporationSystems and methods for compression of key sets having multiple keys
US6889208 *9 Mar 20003 May 2005Victor Company Of Japan, Ltd.Contents sale system
US689539217 Dec 200117 May 2005Contentguard Holdings, Inc.Usage rights grammar and digital works having usage rights created with the grammar
US689540721 Apr 200217 May 2005Emotion, Inc.Method and apparatus for digital media management, retrieval, and collaboration
US69014574 Nov 199831 May 2005Sandisk CorporationMultiple mode communications system
US691002214 Jul 200321 Jun 2005Contentguard Holdings, Inc.Usage rights grammar and digital works having usage rights created with the grammar
US691229429 Dec 200028 Jun 2005Contentguard Holdings, Inc.Multi-stage watermarking process and system
US69204366 Feb 200319 Jul 2005Contentguard Holdings, Inc.Digital work structure
US692544814 Jul 20032 Aug 2005Contentguard Holdings, Inc.Usage rights grammar and digital works having usage rights created with the grammar
US692816320 Jul 19999 Aug 2005International Business Machines CorporationMethods, systems and computer program products for generating user-dependent RSA values without storing seeds
US692841931 Mar 20039 Aug 2005Contentguard Holdings, Inc.Method and apparatus for repackaging portions of digital works as new digital works
US693151213 Nov 200116 Aug 2005Hughes Electronics CorporationMethod and apparatus for selectively retrieving information from a source computer using a terrestrial or satellite interface
US693154528 Aug 200016 Aug 2005Contentguard Holdings, Inc.Systems and methods for integrity certification and verification of content consumption environments
US693425528 Jan 200023 Aug 2005Packeteer, Inc.Internet over satellite apparatus
US693469324 Jun 200223 Aug 2005Contentguard Holdings, Inc.System for controlling the distribution and use of digital works
US693772621 Dec 199930 Aug 2005Contentguard Holdings, Inc.System and method for protecting data files by periodically refreshing a decryption key
US693807524 Dec 199830 Aug 2005Computer Associates Think, Inc.Method and apparatus for hierarchical software distribution packages including composite packages
US69409762 Jun 19996 Sep 2005International Business Machines CorporationGenerating user-dependent RSA keys
US694429721 Aug 200213 Sep 2005Sony CorporationMethod and apparatus for reproducing ciphered data
US69446007 Feb 200113 Sep 2005Contentguard Holdings, Inc.System for controlling the distribution and use of digital works using digital tickets
US694807327 Jun 200120 Sep 2005Microsoft CorporationProtecting decrypted compressed content and decrypted decompressed content at a digital rights management client
US695086731 Jul 200027 Sep 2005Intertrust Technologies Corp.System and method for managing transaction record delivery using an acknowledgement-monitoring process and a failure-recovery process with modifying the predefined fault condition
US69569475 Nov 200418 Oct 2005Microsoft CorporationExtraction of multiple single keys from a compressed key
US695719318 Jun 200318 Oct 2005Contentguard Holdings, Inc.Repository with security class and method for use thereof
US69571945 Jun 200318 Oct 2005Contentguard Holdings, Inc.Method for printing digital works
US69592881 Feb 199925 Oct 2005International Business Machines CorporationDigital content preparation system
US696385916 Jan 20038 Nov 2005Contentguard Holdings, Inc.Content rendering repository
US6973368 *2 Apr 20046 Dec 2005Siemens AktiengesellschaftMethod and device for reliably switching an operating mode of an industrial controller for machine tools or production machines
US697344413 Jan 20006 Dec 2005Microsoft CorporationMethod for interdependently validating a digital content package and a corresponding digital license
US697344531 May 20016 Dec 2005Contentguard Holdings, Inc.Demarcated digital content and method for creating and processing demarcated digital works
US697600931 May 200113 Dec 2005Contentguard Holdings, Inc.Method and apparatus for assigning consequential rights to documents and documents having such rights
US69783758 Sep 200020 Dec 2005International Business Machines CorporationSystem and method for secure authentication of external software modules provided by third parties
US698337113 Nov 20003 Jan 2006International Business Machines CorporationSuper-distribution of protected digital content
US698588521 Sep 200010 Jan 2006Intertrust Technologies Corp.Systems and methods for pricing and selling digital goods
US698604329 May 200110 Jan 2006Microsoft CorporationEncrypting file system and method
US70036755 Nov 200421 Feb 2006Microsoft CorporationEncrypted content data structure package and generation thereof
US701069722 Apr 20027 Mar 2006Protexis, Inc.System for dynamically encrypting information for secure internet commerce and providing embedded fulfillment software
US701080825 Aug 20007 Mar 2006Microsoft CorporationBinding digital content to a portable storage device or the like in a digital rights management (DRM) system
US702439218 Jun 20034 Apr 2006Contentguard Holdings, Inc.Method for controlling use of database content
US702439313 Jan 20004 Apr 2006Microsoft CorporationStructural of digital rights management (DRM) system
US70280093 Jun 200211 Apr 2006Contentguardiholdings, Inc.Method and apparatus for distributing enforceable property rights
US702818721 Aug 199811 Apr 2006Citibank, N.A.Electronic transaction apparatus for electronic commerce
US70314717 Feb 200118 Apr 2006Contentguard Holdings, Inc.System for controlling the distribution and use of rendered digital works through watermarking
US70354279 Apr 200425 Apr 2006Digimarc CorporationMethod and system for managing, accessing and paying for the use of copyrighted electronic media
US703961528 Sep 20002 May 2006Microsoft CorporationRetail transactions involving digital content in a digital rights management (DRM) system
US704345315 Apr 20039 May 2006Contentguard Holdings, Inc.Method and system for conducting transactions between repositories using a repository transaction protocol
US704724111 Oct 199616 May 2006Digimarc CorporationSystem and methods for managing digital creative works
US70474215 Nov 200416 May 2006Microsoft CorporationData signal with a database and a compressed key
US70474225 Nov 200416 May 2006Microsoft CorporationUser access to a unique data subset of a database
US705100513 Jan 200023 May 2006Microsoft CorporationMethod for obtaining a black box for performing decryption and encryption functions in a digital rights management (DRM) system
US70538994 Nov 200330 May 2006Micron Technology Inc.Animation packager for an on-line book
US705860618 Jun 20036 Jun 2006Contentguard Holdings, Inc.Method for loaning digital works
US7062045 *6 Sep 200113 Jun 2006Clwt, LlcMedia protection system and method
US706521611 Aug 200020 Jun 2006Microsoft CorporationMethods and systems of protecting digital content
US706550510 Jun 200320 Jun 2006Contentguard Holdings, Inc.Method for metering and pricing of digital works
US706878724 Mar 200027 Jun 2006Contentguard Holdings, Inc.System and method for protection of digital works
US706945017 Dec 200427 Jun 2006Benaloh Josh DSystems and methods for compression of key sets having multiple keys
US707306327 Jun 20014 Jul 2006Microsoft CorporationBinding a digital license to a portable device or the like in a digital rights management (DRM) system and checking out/checking in the digital license to/from the portable device or the like
US707319928 Aug 20004 Jul 2006Contentguard Holdings, Inc.Document distribution management method and apparatus using a standard rendering engine and a method and apparatus for controlling a standard rendering engine
US70802625 Nov 200418 Jul 2006Microsoft CorporationKey compression
US70804107 Jul 200518 Jul 2006Microsoft CorporationProtecting decrypted compressed content and decrypted decompressed content at a digital rights management client
US708574117 Jan 20021 Aug 2006Contentguard Holdings, Inc.Method and apparatus for managing digital content usage rights
US708942518 Mar 20038 Aug 2006Ci4 Technologies, Inc.Remote access authorization of local content
US70963588 Sep 200322 Aug 2006Maz Technologies, Inc.Encrypting file system
US710357412 Apr 19995 Sep 2006Microsoft CorporationEnforcement architecture and method for digital rights management
US7103912 *29 Jun 20015 Sep 2006International Business Machines CorporationUser authorization management system using a meta-password and method for same
US711098413 Nov 200019 Sep 2006International Business Machines CorporationUpdating usage conditions in lieu of download digital rights management protected content
US711391217 Dec 200126 Sep 2006Contentguard Holdings, Inc.Composite digital works having usage rights and method for creating the same
US712443714 Jan 200517 Oct 2006Protexis, Inc.System for dynamically encrypting information for secure internet commerce and providing embedded fulfillment software
US712751515 Jan 199924 Oct 2006Drm Technologies, LlcDelivering electronic content
US713083110 Sep 199931 Oct 2006Copyright Clearance Center, Inc.Limited-use browser and security system
US713683813 Jan 200014 Nov 2006Microsoft CorporationDigital license and method for obtaining/providing a digital license
US713702528 Feb 200214 Nov 2006Hitachi, Ltd.Key controlling system, key controlling apparatus, information encrypting apparatus, information decrypting apparatus and storage media for storing programs
US71397368 Aug 200521 Nov 2006Contentguard Holdings, Inc.Content rendering repository
US7143067 *9 Feb 199928 Nov 2006Lenovo (Singapore) Pte. Ltd.System and method for installing personal computer software
US714920825 Sep 199612 Dec 2006Net2Phone, Inc.Method and apparatus for providing caller identification based responses in a computer telephony environment
US714972228 Sep 200012 Dec 2006Microsoft CorporationRetail transactions involving distributed and super-distributed digital content in a digital rights management (DRM) system
US71520467 Jun 200219 Dec 2006Contentguard Holdings, Inc.Method and apparatus for tracking status of resource in a system for managing use of the resources
US715216517 Jul 200019 Dec 2006Intertrust Technologies Corp.Trusted storage systems and methods
US71586395 Nov 20042 Jan 2007Microsoft CorporationKey generation
US716263322 Apr 20059 Jan 2007Contentguard Holdings, Inc.Method and apparatus for hierarchical assignment of rights to documents and documents having such rights
US71627457 Jul 20059 Jan 2007Microsoft CorporationProtecting decrypted compressed content and decrypted decompressed content at a digital rights management client
US71779759 Apr 200113 Feb 2007Sandisk CorporationCard system with erase tagging hierarchy and group based write protection
US71810086 Jul 200020 Feb 2007Kabushiki Kaisha ToshibaContents management method, content management apparatus, and recording medium
US718101627 Jan 200320 Feb 2007Microsoft CorporationDeriving a symmetric key from an asymmetric key for file encryption or decryption
US71845712 Jun 200527 Feb 2007Contentgaurd Holdings, Inc.Multi-stage watermarking process and system
US720023015 Jan 20013 Apr 2007Macrovision CorporationSystem and method for controlling and enforcing access rights to encrypted media
US720057420 Dec 20043 Apr 2007Contentguard Holdings, Inc.System for controlling the distribution and use digital works using digital tickets
US720674810 Dec 199817 Apr 2007International Business Machines CorporationMultimedia player toolkit for electronic content delivery
US72067653 Jun 200317 Apr 2007Contentguard Holdings, Inc.System and method for supplying and managing usage rights based on rules
US720694130 Apr 200317 Apr 2007Contentguard Holdings, Inc.Method and apparatus for validating security components through a request for content
US720990225 Mar 200524 Apr 2007Contentguard Holdings, Inc.Repository with security class and method for use thereof
US721300520 Jan 20001 May 2007International Business Machines CorporationDigital content distribution using web broadcasting services
US72163484 Jan 20008 May 2007Net2Phone, Inc.Method and apparatus for dynamically balancing call flow workloads in a telecommunications system
US722210431 May 200122 May 2007Contentguard Holdings, Inc.Method and apparatus for transferring usage rights and digital work having transferrable usage rights
US7222233 *14 Sep 200122 May 2007At&T Corp.Method for secure remote backup
US722515721 Dec 200029 May 2007Copyright Clearance Center, Inc.Limited-use browser and security system
US722516017 Dec 200129 May 2007Contentguard Holdings, Inc.Digital works having usage rights and method for creating the same
US723166927 Feb 200612 Jun 2007Microsoft CorporationBinding content to a portable storage device or the like in a digital rights management (DRM) system
US723460915 Apr 200426 Jun 2007Redbox Automated Retail, L.L.C.Article dispensing system and method for same
US723632027 Jul 200526 Jun 2007Sony CorporationRecording medium and apparatus for protecting copyrighted digital data
US723712530 Apr 200326 Jun 2007Contentguard Holdings, Inc.Method and apparatus for automatically deploying security components in a content distribution system
US723970827 Jun 20013 Jul 2007Microsoft CorporationProtecting decrypted compressed content and decrypted decompressed content at a digital rights management client
US72462467 Feb 200317 Jul 2007Iomega CorporationSystem for keying protected electronic data to particular media to prevent unauthorized copying using a compound key
US724871727 Jul 200524 Jul 2007Digimarc CorporationSecuring media content with steganographic encoding
US725183212 Mar 200431 Jul 2007Drm Technologies, LlcSecure streaming container
US726055620 Apr 200521 Aug 2007Contentguard Holdings, Inc.Content rendering device with usage rights
US726652924 May 20054 Sep 2007Contentguard Holdings, Inc.Method and apparatus for executing code in accordance with usage rights
US726670418 Apr 20024 Sep 2007Digimarc CorporationUser-friendly rights management systems and methods
US726956430 Nov 199811 Sep 2007International Business Machines CorporationMethod and apparatus to indicate an encoding status for digital content
US72695769 Feb 200411 Sep 2007Contentguard Holdings, Inc.Content rendering apparatus
US726957726 May 200411 Sep 2007Contentguard Holdings, Inc.System for controlling the distribution and use of digital works using digital tickets
US726973530 Apr 200311 Sep 2007Contentgaurd Holdings, Inc.Instance specific digital watermarks
US727265528 Apr 200618 Sep 2007Drm Technologies, LlcDelivering electronic content
US727724817 Oct 20062 Oct 2007Sony CorporationRecording medium and apparatus for protecting copyrighted digital data
US727787014 Oct 20052 Oct 2007International Business Machines CorporationDigital content distribution using web broadcasting services
US728666521 Dec 199923 Oct 2007Contentguard Holdings, Inc.System and method for transferring the right to decode messages
US7302415 *3 Jan 200027 Nov 2007Intarsia LlcData copyright management system
US731073123 Jul 200418 Dec 2007Sony CorporationContents processing system
US731975915 Mar 200015 Jan 2008Microsoft CorporationProducing a new black box for a digital rights management (DRM) system
US731998820 Oct 200415 Jan 2008Sl Patent Holdings LlcSystem and method for processing protected audio information
US732506322 Oct 200329 Jan 2008Hughes Electronics CorporationApparatus, method, and system for removing ethernet header and adding second IP header
US733723331 Dec 200326 Feb 2008Hughes Network Systems, Inc.Network system with TCP/IP protocol spoofing
US7340061 *11 May 20004 Mar 2008Sony CorporationInformation processing apparatus, information processing method and providing medium
US734332421 Feb 200111 Mar 2008Contentguard Holdings Inc.Method, system, and computer readable medium for automatically publishing content
US73433984 Sep 200211 Mar 2008Packeteer, Inc.Methods, apparatuses and systems for transparently intermediating network traffic over connection-based authentication protocols
US7343491 *6 Jul 200111 Mar 2008Sony CorporationInformation processing apparatus and method
US734349328 Mar 200211 Mar 2008Lenovo (Singapore) Pte. Ltd.Encrypted file system using TCPA
US735320530 Dec 20041 Apr 2008Sl Patent Holdings LlcMethod for causing a digital product to revert to a demo mode
US735320715 Dec 20041 Apr 2008Sl Patent Holdings LlcMethod of altering a software product in response to predetermined events
US735320915 Mar 20001 Apr 2008Microsoft CorporationReleasing decrypted digital content to an authenticated path
US735668821 Dec 19998 Apr 2008Contentguard Holdings, Inc.System and method for document distribution
US7356709 *31 Jan 20038 Apr 2008Microsoft CorporationSystems and methods for deterring software piracy in a volume license environment
US735684722 Apr 20028 Apr 2008Protexis, Inc.System for dynamically encrypting content for secure internet commerce and providing embedded fulfillment software
US73591379 Aug 200715 Apr 2008Sony CorporationRecording medium and apparatus for protecting copyrighted digital data
US73598817 Feb 200115 Apr 2008Contentguard Holdings, Inc.System for controlling the distribution and use of digital works using secure components
US736000326 Jan 200515 Apr 2008Sandisk CorporationMultiple mode communication system
US7362868 *20 Oct 200022 Apr 2008Eruces, Inc.Hidden link dynamic key manager for use in computer systems with database structure for storage of encrypted data and method for storage and retrieval of encrypted data
US737410812 Feb 200720 May 2008Sandisk CorporationWrite protection and use of erase tags in a single host multiple cards system
US738012012 Feb 200227 May 2008Guardian Data Storage, LlcSecured data format for access control
US738013226 Mar 200227 May 2008Sony CorporationData recording method and apparatus, data record medium and data reproducing method and apparatus
US738320513 Jan 20003 Jun 2008Microsoft CorporationStructure of a digital content package
US738344725 Jul 20053 Jun 2008Intarsia Software LlcMethod for controlling database copyrights
US738689110 May 200610 Jun 2008Microsoft CorporationBinding a digital license to a portable device or the like in a digital rights management (DRM) system and checking out/checking in the digital license to/from the portable device or the like
US73892708 Aug 200517 Jun 2008Contentguard Holdings, Inc.System for controlling the distribution and use of digital works
US7398556 *17 Feb 20048 Jul 2008Koninklijke Philips Electronics N.V.System and method for managing copyrighted electronic media
US740660331 Aug 200029 Jul 2008Intertrust Technologies Corp.Data protection systems and methods
US7409063 *27 Mar 20025 Aug 2008Sony Computer Entertainment Inc.Contents distribution system
US74120615 Nov 200412 Aug 2008Microsoft CorporationEncrypting a digital object on a key ID selected therefor
US741260530 Apr 200312 Aug 2008Contentguard Holdings, Inc.Method and apparatus for variable encryption of data
US741844421 Apr 200226 Aug 2008Corbis CorporationMethod and apparatus for digital media management, retrieval, and collaboration
US742174120 Oct 20042 Sep 2008Phillips Ii Eugene BSecuring digital content system and method
US74334744 Jan 20027 Oct 2008Kabushiki Kaisha ToshibaMethod and apparatus of enciphering and deciphering data using keys enciphered and deciphered with other keys
US744429625 May 200028 Oct 2008Dvdplay, Inc.Disk dispensing and retrieval system and associated methods
US744791416 Jul 19974 Nov 2008Intarsia Software LlcMethod for controlling database copyrights
US747823919 May 199913 Jan 2009Citibank, N.A.Electronic ticket vending system
US747841826 Jun 200213 Jan 2009Guardian Data Storage, LlcGuaranteed delivery of changes to security policies in a distributed system
US748712811 Oct 20053 Feb 2009International Business Machines CorporationUpdating usage conditions in lieu of download digital rights management protected content
US749956622 Jul 20053 Mar 2009Digimarc CorporationMethods for steganographic encoding media
US75001081 Mar 20043 Mar 2009Microsoft CorporationMetered execution of code
US75001096 May 20053 Mar 2009International Business Machines CorporationSystem and method for secure authentication of external software modules provided by third parties
US750558419 Apr 200617 Mar 2009Kabushiki Kaisha ToshibaContents management method, contents management apparatus, and recording medium
US7505945 *20 Dec 200017 Mar 2009Cryptomathic A/SElectronic negotiable documents
US7506367 *15 Sep 199917 Mar 2009Sony CorporationContent management method, and content storage system
US751281011 Sep 200231 Mar 2009Guardian Data Storage LlcMethod and system for protecting encrypted files transmitted over a network
US752307216 Dec 200521 Apr 2009Contentguard Holdings, Inc.System for controlling the distribution and use of digital works
US752319415 Sep 200421 Apr 2009Intertrust Technologies CorporationMethods and systems for transaction record delivery using thresholds and multi-stage protocol
US752330330 Apr 200421 Apr 2009Nec CorporationSystem and method for distributing digital works, apparatus and method for reproducing digital works, and computer program product
US75299273 Nov 20045 May 2009Microsoft CorporationSpecifying security for an element by assigning a scaled value representative of the relative security thereof
US753601628 Sep 200519 May 2009Microsoft CorporationEncrypted content data structure package and generation thereof
US754905110 Mar 200516 Jun 2009Microsoft CorporationLong-life digital certification for publishing long-life digital content or the like in content rights management system or the like
US754906328 Jul 200516 Jun 2009Microsoft CorporationMethods and systems of protecting digital content
US755546313 Nov 200630 Jun 2009Sl Patent Holdings LlcSystem and method for selectively changing parameter settings based on lineage analysis of digital information
US755555815 Aug 200330 Jun 2009Michael Frederick KenrichMethod and system for fault-tolerant transfer of files across a network
US75557855 Feb 200730 Jun 2009Digimarc CorporationMethod and apparatus for content management
US75621307 Dec 200114 Jul 2009Hughes Network Systems, Inc.Method and apparatus for selectively allocating and enforcing bandwidth usage requirements on network users
US756215015 Aug 200714 Jul 2009Drm Technologies, LlcDelivering electronic content
US756223225 Jul 200214 Jul 2009Patrick ZuiliSystem and method for providing manageability to security information for secured items
US756568326 Jun 200221 Jul 2009Weiqing HuangMethod and system for implementing changes to security policies in a distributed security system
US757783820 Dec 200218 Aug 2009Alain RossmannHybrid systems for securing digital assets
US758109220 Aug 200725 Aug 2009Intertrust Technologies CorporationSystems and methods using cryptography to protect secure computing environments
US759085320 Aug 200715 Sep 2009Intertrust Technologies CorporationSystems and methods using cryptography to protect secure computing environments
US759086621 Oct 200515 Sep 2009International Business Machines CorporationSuper-distribution of protected digital content
US76030259 Dec 200313 Oct 2009Ati Technologies SrlMethod and apparatus for copy protection detection in a video signal
US760331930 Apr 200313 Oct 2009Contentguard Holdings, Inc.Method and apparatus for preserving customer identity in on-line transactions
US760984824 Aug 200527 Oct 2009Contentguard Holdings, Inc.Multi-stage watermarking process and system
US761330217 Dec 20043 Nov 2009Microsoft CorporationSystems and methods for compression of key sets having multiple keys
US762445119 May 200524 Nov 2009Microsoft CorporationBinding a digital license to a portable or the like in a digital rights management (DMR) system and checking out/checking in the digital license to/from the portable device or the like
US763118414 May 20028 Dec 2009Nicholas RyanSystem and method for imposing security on copies of secured items
US76442654 Feb 20045 Jan 2010Hitachi, Ltd.Content transmitting device, content receiving device and content transmitting method
US764444224 Mar 20055 Jan 2010Microsoft CorporationSystems and methods for using machine attributes to deter software piracy in an enterprise environment
US765050423 Aug 200419 Jan 2010Macrovision CorporationSystem and method of verifying the authenticity of dynamically connectable executable images
US765266923 Sep 200526 Jan 2010Micron Technology, Inc.Animation packager for an on-line book
US76536878 Jun 200726 Jan 2010Reisman Richard RMethod for distributing content to a user station
US76647083 Oct 200516 Feb 2010Contentguard Holdings, Inc.System for controlling the distribution and use of digital works using digital tickets
US767305930 Mar 20042 Mar 2010Drm Technologies, LlcTracking electronic content
US7673155 *9 May 20082 Mar 2010Kabushiki Kaisha ToshibaMicroprocessor with improved task management and table management mechanism
US768074031 Oct 200716 Mar 2010Lg Electronics Inc.Managing copy protecting information of encrypted data
US768074315 May 200216 Mar 2010Microsoft CorporationSoftware application protection by way of a digital rights management (DRM) system
US768074428 Apr 200516 Mar 2010Microsoft CorporationMethod for interdependently validating a digital content package and a corresponding digital license
US768103412 Feb 200216 Mar 2010Chang-Ping LeeMethod and apparatus for securing electronic data
US768103510 Sep 200316 Mar 2010Realnetworks, Inc.Digital rights management handler and related methods
US768104217 Jun 200416 Mar 2010Eruces, Inc.System and method for dis-identifying sensitive information and associated records
US768124023 Jan 200616 Mar 2010Intertrust Technologies CorporationTrusted storage systems and methods
US768982722 May 200730 Mar 2010Intertrust Technologies Corp.Systems and methods for using cryptography to protect secure and insecure computing environments
US769328022 Apr 20056 Apr 2010Microsoft CorporationRights management system for streamed multimedia content
US770314030 Sep 200320 Apr 2010Guardian Data Storage, LlcMethod and system for securing digital assets using process-driven security policies
US770742719 Jul 200427 Apr 2010Michael Frederick KenrichMulti-level file digests
US77167459 Jun 200811 May 2010Microsoft CorporationBinding a digital license to a portable device or the like in a digital rights management (DRM) system and checking out/checking in the digital license to/from the portable device or the like
US77254018 Feb 200525 May 2010Contentguard Holdings, Inc.Method and apparatus for establishing usage rights for digital content to be created in the future
US772999522 Jul 20021 Jun 2010Rossmann AlainManaging secured files in designated locations
US7730323 *6 Nov 20061 Jun 2010Makoto SaitoControlling database copyrights
US7730324 *2 Nov 20011 Jun 2010Makoto SaitoMethod for controlling database copyrights
US773455320 Aug 20078 Jun 2010Intertrust Technologies Corp.Systems and methods using cryptography to protect secure computing environments
US774325916 Jan 200222 Jun 2010Contentguard Holdings, Inc.System and method for digital rights management using a standard rendering engine
US774342715 Jun 200622 Jun 2010Arvato Digital Services Canada, Inc.System for dynamically encrypting information for secure internet commerce and providing embedded fulfillment software
US775245525 Jan 20066 Jul 2010Intertust Technologies Corp.Trusted storage systems and methods
US775246620 Aug 20076 Jul 2010Intertrust Technologies Corp.Systems and methods for secure transaction management and electronic rights protection
US77570775 Nov 200413 Jul 2010Microsoft CorporationSpecifying security for an element by assigning a scaled value representative of the relative security thereof
US776191620 Aug 200720 Jul 2010Intertrust Technologies CorporationSystems and methods using cryptography to protect secure computing environments
US77654033 Jun 200527 Jul 2010Contentguard Holdings, Inc.System for controlling the distribution and use of rendered digital works through watermarking
US777003119 Jun 20083 Aug 2010Intertrust Technologies Corp.Data protection systems and methods
US777023030 Oct 20073 Aug 2010Arvato Digital Services Canada, Inc.System for dynamically encrypting content for secure internet commerce and providing embedded fulfillment software
US777423323 Oct 200610 Aug 2010Ncr CorporationSystem and kiosk for commerce of optical media through multiple locations
US77742795 Jun 200210 Aug 2010Contentguard Holdings, Inc.Rights offering and granting
US77742804 Oct 200410 Aug 2010Contentguard Holdings, Inc.System and method for managing transfer of rights using shared state variables
US77745018 Sep 200410 Aug 2010Hughes Network Systems, LlcNetwork layer tunnel apparatus having transport layer/network layer stack and network layer tunnel and method using network layer tunnel
US777926019 Dec 200717 Aug 2010Sony CorporationInformation processing apparatus and method
US778376512 Feb 200224 Aug 2010Hildebrand Hal SSystem and method for providing distributed access control to secured documents
US778817831 Oct 200731 Aug 2010Lg Electronics Inc.Recording medium containing sample data and reproducing thereof
US778818212 Apr 200631 Aug 2010Contentguard Holdings, Inc.Method for loaning digital works
US77884968 Oct 200331 Aug 2010Microsoft CorporationFirst computer process and second computer process proxy-executing code on behalf thereof
US779707721 Apr 200614 Sep 2010Redbox Automated Retail, LlcSystem and method for managing vending inventory
US780181720 Jul 200621 Sep 2010Makoto SaitoDigital content management system and apparatus
US7805611 *3 Dec 200428 Sep 2010Oracle America, Inc.Method for secure communication from chip card and system for performing the same
US78096447 Jul 20055 Oct 2010Contentguard Holdings, Inc.Digital work structure
US782710913 Dec 20012 Nov 2010Makoto SaitoDigital content management system and apparatus
US78315166 Dec 20069 Nov 2010Sl Patent Holdings LlcSystem and method for redistributing and licensing access to protected information among a plurality of devices
US783182313 Jul 20079 Nov 2010Intertrust Technologies Corp.Systems and methods for secure transaction management and electronic rights protection
US78363101 Nov 200216 Nov 2010Yevgeniy GutnikSecurity system that uses indirect password-based encryption
US7836507 *17 May 200416 Nov 2010Hitachi, Ltd.Contents transmitter apparatus, contents receiver apparatus and contents transmitting method
US78535315 Jun 200214 Dec 2010Contentguard Holdings, Inc.Method and apparatus for supporting multiple trust zones in a digital rights management system
US785640414 Apr 200521 Dec 2010Microsoft CorporationPlaylist burning in rights-management context
US78774129 May 200525 Jan 2011Homer Gregg SRechargeable media distribution and play system
US787890814 Nov 20021 Feb 2011Nintendo Co., Ltd.Multiplexed secure video game play distribution
US788074411 May 20071 Feb 2011Sony CorporationGeometric instance techniques for use in a hair/fur pipeline
US7881478 *10 Jun 20021 Feb 2011Nagra Thomson LicensingMethod for controlling access to an encrypted programme
US78904284 Feb 200515 Feb 2011Microsoft CorporationFlexible licensing architecture for licensing digital application
US789099020 Dec 200215 Feb 2011Klimenty VainsteinSecurity system with staging capabilities
US7899189 *9 Dec 20041 Mar 2011International Business Machines CorporationApparatus, system, and method for transparent end-to-end security of storage data in a client-server environment
US790470720 Aug 20078 Mar 2011Intertrust Technologies Corp.Systems and methods using cryptography to protect secure computing environments
US790774915 Sep 200915 Mar 2011Contentguard Holdings, Inc.Multi-stage watermarking process and system
US791309530 Apr 200322 Mar 2011Contentguard Holdings, Inc.Method and apparatus for providing a specific user interface in a system for managing content
US791331110 Aug 200722 Mar 2011Rossmann AlainMethods and systems for providing access control to electronic data
US792128431 May 20025 Apr 2011Gary Mark KinghornMethod and system for protecting electronic data in enterprise environment
US792128820 Mar 20025 Apr 2011Hildebrand Hal SSystem and method for providing different levels of key security for controlling access to secured items
US792145015 Nov 20025 Apr 2011Klimenty VainsteinSecurity system using indirect key generation from access rules and methods therefor
US792559128 Mar 200612 Apr 2011Microsoft CorporationRetail transactions involving digital content in a digital rights management (DRM) system
US793075631 Mar 200319 Apr 2011Crocker Steven ToyeMulti-level cryptographic transformations for securing digital assets
US793376528 Mar 200726 Apr 2011Corbis CorporationCross-lingual information retrieval
US793382928 Oct 200526 Apr 2011Intertrust Technologies Corp.Systems and methods for pricing and selling digital goods
US795006621 Dec 200124 May 2011Guardian Data Storage, LlcMethod and system for restricting use of a clipboard application
US796188224 Sep 200714 Jun 2011Broadcom CorporationMethods and apparatus for initialization vector pressing
US7962417 *30 Sep 200414 Jun 2011Sl Patent Holdings LlcSystem and method for distributing protected information
US7969979 *28 Sep 200428 Jun 2011Runcom Technologies Ltd.Distribution of multicast data to users
US797935431 Aug 200612 Jul 2011Intarsia Software LlcControlling database copyrights
US797954212 Mar 200912 Jul 2011Intertrust Technologies CorporationMethods and systems for transaction record delivery using thresholds and multi-stage protocol
US797969729 Jul 200812 Jul 2011Digital Reg Of Texas, LlcSecuring digital content system and method
US797991127 May 200512 Jul 2011Microsoft CorporationFirst computer process and second computer process proxy-executing code from third computer process on behalf of first process
US798450925 May 200719 Jul 2011Intertrust Technologies CorporationSystems and methods for secure transaction management and electronic rights protection
US798678529 Aug 200626 Jul 2011Intarsia Software LlcData management
US798750221 Jun 200726 Jul 2011Digital Reg Of Texas, LlcSecure streaming container
US80010534 Oct 200416 Aug 2011Contentguard Holdings, Inc.System and method for rights offering and granting using shared state variables
US80016082 Jul 200716 Aug 2011Digital Reg Of Texas, LlcSecure streaming container
US80057575 Nov 200423 Aug 2011Microsoft CorporationSpecifiying security for an element by assigning a scaled value representative of the relative security thereof
US800608729 Oct 200723 Aug 2011Intertrust Technologies CorporationSystems and methods for secure transaction management and electronic rights protection
US800628017 Sep 200223 Aug 2011Hildebrand Hal SSecurity system for generating keys from access rules in a decentralized manner and methods therefor
US801079217 May 200430 Aug 2011Hitachi, Ltd.Content transmission apparatus, content reception apparatus and content transmission method
US80242271 May 200720 Sep 2011Kualo Properties Au, LlcLimited-use browser and security system
US802439931 Aug 200620 Sep 2011Twintech E.U., Limited Liability CompanySoftware distribution over a network
US80245691 May 200720 Sep 2011At&T Intellectual Property Ii, L.P.Method for secure remote backup
US80248103 Jul 200620 Sep 2011Intarsia Software LlcMethod and apparatus for protecting digital data by double re-encryption
US805589919 Aug 20058 Nov 2011Digimarc CorporationSystems and methods using digital watermarking and identifier extraction to provide promotional opportunities
US805591320 Aug 20078 Nov 2011Intertrust Technologies CorporationSystems and methods for secure transaction management and electronic rights protection
US806024727 Aug 200915 Nov 2011Redbox Automated Retail, LlcSystem and method for communicating secondary vending options
US806571312 Feb 200222 Nov 2011Klimenty VainsteinSystem and method for providing multi-location access management to secured items
US80691163 Jun 200329 Nov 2011Contentguard Holdings, Inc.System and method for supplying and managing usage rights associated with an item repository
US806920431 Aug 200629 Nov 2011Twintech E.U., Limited Liability CompanyProviding and receiving content over a wireless communication system
US807382814 Jun 20076 Dec 2011Curbis CorporationLicensed rights clearance and tracking for digital assets
US807854228 Jun 201013 Dec 2011Contentguard Holdings, Inc.System and method for managing transfer of rights using shared state variables
US807908816 Nov 200713 Dec 2011Sony CorporationInformation processing apparatus, information processing method, and program
US808674615 Jun 200927 Dec 2011Digital Reg of Texas, LLC.Delivering electronic content
US809114226 Apr 20053 Jan 2012Microsoft CorporationSupplementary trust model for software licensing/commercial digital distribution policy
US80993646 Jun 200217 Jan 2012Contentguard Holdings, Inc.Digital rights management of content when content is a future live event
US810359214 Nov 200524 Jan 2012Microsoft CorporationFirst computer process and second computer process proxy-executing code on behalf of first process
US811262529 Sep 20107 Feb 2012Intertrust Technologies CorporationSystems and methods for secure transaction management and electronic rights protection
US812736630 Sep 200328 Feb 2012Guardian Data Storage, LlcMethod and apparatus for transitioning between states of security policies used to secure electronic documents
US813188320 Apr 20006 Mar 2012Intellectual Ventures I, Limited Liability CompanyMethod for distributing content to a user station
US81404354 Nov 200420 Mar 2012Sl Patent Holdings LlcSystem and method for processing protected text information
US814043729 Aug 200620 Mar 2012Lg Electronics Inc.Method of recording and reproducing sample data to/from a recording medium and sample data containing recording medium
US814116513 Jul 200720 Mar 2012Intertrust Technologies CorporationSystems and methods for secure transaction management and electronic rights protection
US817095531 Dec 20091 May 2012Contentguard Holdings, Inc.System and method for enforcing usage rights associated with digital content
US817633430 Sep 20028 May 2012Guardian Data Storage, LlcDocument security system that permits external users to gain access to secured files
US818102120 Aug 200715 May 2012Intertrust Technologies Corp.Systems and methods for secure transaction management and electronic rights protection
US818126515 Sep 200515 May 2012Microsoft CorporationSecure machine counting
US818596729 Jun 200922 May 2012Digimarc CorporationMethod and apparatus for content management
US819115725 Jun 200729 May 2012Intertrust Technologies CorporationSystems and methods for secure transaction management and electronic rights protection
US819115820 Aug 200729 May 2012Intertrust Technologies CorporationSystems and methods for secure transaction management and electronic rights protection
US82050896 Aug 200919 Jun 2012Contentguard Holdings, Inc.System for controlling the distribution and use of rendered digital works through watermarking
US82095347 Oct 201026 Jun 2012Hitachi, Ltd.Contents transmitter apparatus, contents receiver apparatus and contents transmitting method
US820954421 May 201026 Jun 2012Intertrust Technologies Corp.Trusted storage systems and methods
US821949416 Aug 200710 Jul 2012Corbis CorporationEnd-to-end licensing of digital media assets
US82250845 Jan 201017 Jul 2012Hitachi, Ltd.Content transmitting device, content receiving device and content transmitting method
US822541430 Apr 200317 Jul 2012Contentguard Holdings, Inc.Method and apparatus for identifying installed software and regulating access to content
US8261075 *19 Sep 20114 Sep 2012At&T Intellectual Property Ii, L.P.Method for secure remote backup
US826667419 Jun 200911 Sep 2012Guardian Data Storage, LlcMethod and system for implementing changes to security policies in a distributed security system
US827135014 Dec 200718 Sep 2012Contentguard Holdings, Inc.Method and system for automatically publishing content
US827570924 Jun 200825 Sep 2012Contentguard Holdings, Inc.Digital rights management of content when content is a future live event
US82757166 Jun 200225 Sep 2012Contentguard Holdings, Inc.Method and system for subscription digital rights management
US82845129 Aug 20079 Oct 2012Sony CorporationRecording medium and apparatus for protecting copyrighted digital data
US828622812 Jul 20119 Oct 2012Digital Reg Of Texas, LlcSecure streaming container
US829087422 Apr 200516 Oct 2012Microsoft CorporationRights management system for streamed multimedia content
US829123812 Jul 200716 Oct 2012Intertrust Technologies Corp.Systems and methods for secure transaction management and electronic rights protection
US830189623 Apr 201030 Oct 2012Guardian Data Storage, LlcMulti-level file digests
US830706719 Feb 20096 Nov 2012Guardian Data Storage, LlcProtecting encrypted files transmitted over a network
US831644913 Jul 200720 Nov 2012Intertrust Technologies CorporationSystems and methods for secure transaction management and electronic rights protection
US832169011 Aug 200527 Nov 2012Microsoft CorporationProtecting digital media of various content types
US83259168 Feb 20104 Dec 2012Microsoft CorporationEncryption scheme for streamed multimedia content protected by rights management system
US83269835 Jul 20114 Dec 2012Intertrust Technologies Corp.Methods and systems for transaction record delivery using thresholds and multi-stage protocol
US832713816 Apr 20104 Dec 2012Guardian Data Storage LlcMethod and system for securing digital assets using process-driven security policies
US833232823 Jun 201011 Dec 2012Sl Patent Holdings LlcSystem and method for redistributing and licensing access to protected information among a plurality of devices
US83411954 Oct 200725 Dec 2012Corbis CorporationPlatform for managing media assets for multi-model licensing over multi-level pricing and asset grouping
US83414064 Apr 201125 Dec 2012Guardian Data Storage, LlcSystem and method for providing different levels of key security for controlling access to secured items
US83414071 Apr 201125 Dec 2012Guardian Data Storage, LlcMethod and system for protecting electronic data in enterprise environment
US83414244 May 200425 Dec 2012Trustees Of Dartmouth CollegeMethods for playing protected content
US834707820 Dec 20041 Jan 2013Microsoft CorporationDevice certificate individualization
US835237328 Jan 20038 Jan 2013Intarsia Software LlcData copyright management system
US835597827 Oct 200515 Jan 2013Intertrust Technologies Corp.Systems and methods for pricing and selling digital goods
US837358229 Aug 200612 Feb 2013Steven M. HoffbergAdaptive pattern recognition based controller apparatus and method and human-factored interface therefore
US8380634 *21 Dec 201119 Feb 2013Microsoft CorporationFirst computer process and second computer process proxy-executing code on behalf of first process
US840255515 Feb 201219 Mar 2013William GreciaPersonalized digital media access system (PDMAS)
US84025579 Jun 201019 Mar 2013Intertrust Technologies CorporationSystems and methods for secure transaction management and electronic rights protection
US840255810 Jun 201119 Mar 2013Digital Reg Of Texas, LlcSecuring digital content system and method
US840778226 Mar 200226 Mar 2013Intarsia Software LlcData copyright management
US841264427 Apr 20102 Apr 2013Contentguard Holdings, Inc.Method and apparatus for establishing usage rights for digital content to be created in the future
US841738013 Dec 20109 Apr 2013Redbox Automated Retail, LlcSystem and method for communicating vending information
US842347320 May 201016 Apr 2013Uniloc Luxembourg S. A.Systems and methods for game activation
US843864527 Apr 20057 May 2013Microsoft CorporationSecure clock with grace periods
US84429166 Mar 201214 May 2013Contentguard Holdings, Inc.Digital rights management of content when content is a future live event
US84482541 Nov 201021 May 2013Intarsia Software LlcDigital content management system and apparatus
US846407122 Jun 201211 Jun 2013Intertrust Technologies CorporationTrusted storage systems and methods
US846407726 Apr 201011 Jun 2013Intertrust Technologies Corp.Systems and methods for secure transaction management and electronic rights protection
US84680986 Mar 201218 Jun 2013Contentguard Holdings, Inc.Method and system for subscription digital rights management
US846835029 Aug 201118 Jun 2013Hitachi, Ltd.Content transmission apparatus, content reception apparatus and content transmission method
US847405822 Aug 200325 Jun 2013Rovi Solutions CorporationMethod and system for managing a data object so as to comply with predetermined conditions for usage
US8479305 *1 Oct 19982 Jul 2013Rovi Solutions CorporationMethod and system for managing a data object so as to comply with predetermined conditions for usage
US8479306 *27 May 19992 Jul 2013Rovi Solutions CorporationMethod and system for managing a data object so as to comply with predetermined condition for usage
US848990021 Mar 201116 Jul 2013Contentguard Holdings, Inc.Method and apparatus for providing a specific user interface in a system for managing content
US849935624 May 201030 Jul 2013Arvato Digital Services Canada, Inc.System for dynamically encrypting information for secure internet commerce and providing embedded fulfillment software
US85048351 Sep 20126 Aug 2013At&T Intellectual Property Ii, L.P.Method for secure remote backup
US851084914 Jun 201013 Aug 2013Intertrust Technologies CorporationData protection systems and methods
US8533851 *12 Apr 200610 Sep 2013Intertrust Technologies CorporationSystems and methods for secure transaction management and electronic rights protection
US853385416 Feb 201110 Sep 2013Intertrust Technologies CorporationSystems and methods for secure transaction management and electronic rights protection
US854382727 Mar 200824 Sep 2013Intellectual Ventures I LlcMethods and systems for providing access control to secured data
US855468411 Jul 20118 Oct 2013Intarsia Software LlcControlling database copyrights
US856696017 Nov 200822 Oct 2013Uniloc Luxembourg S.A.System and method for adjustable licensing of digital products
US857241114 May 201029 Oct 2013Intertrust Technologies CorporationSystems and methods for secure transaction management and electronic rights protection
US857846429 Aug 20125 Nov 2013Digital Reg Of Texas, LlcSecure streaming container
US859550023 Jul 201026 Nov 2013Sony CorporationInformation processing apparatus and method
US859550225 May 200626 Nov 2013Intarsia Software LlcData management system
US861310230 Mar 200417 Dec 2013Intellectual Ventures I LlcMethod and system for providing document retention using cryptography
US861311019 Apr 201217 Dec 2013Uniloc Luxembourg S.A.Software piracy prevention through remote enforcement of an activation threshold
US862488811 May 20077 Jan 2014Sony CorporationScreen space optimization techniques for use in a hair/fur pipeline
US862488923 Jul 20077 Jan 2014Sony CorporationMultiple instantiable effects in a hair/fur pipeline
US862661423 Oct 20067 Jan 2014Redbox Automated Retail, LlcSystem and kiosk for commerce of optical media through multiple locations
US8630417 *26 Nov 200814 Jan 2014Nagravision S.A.Method for recording and restoring a ciphered content by a processing unit
US863957823 Oct 200828 Jan 2014Redbox Automated Retail, LlcDisk dispensing and retrieval system and associated methods
US863962530 Jul 200728 Jan 2014Intertrust Technologies CorporationSystems and methods for secure transaction management and electronic rights protection
US864025617 Jan 201228 Jan 2014Microsoft CorporationFile system operation and digital rights management (DRM)
US20060080257 *8 Oct 200413 Apr 2006Level 3 Communications, Inc.Digital content distribution framework
US20060200392 *4 May 20067 Sep 2006Intertrust Technologies Corp.Cryptographic methods, apparatus and systems for storage media electronic rights management in closed and connected appliances
US20090007258 *5 Jan 20071 Jan 2009Verichk Global Technologies Inc.Secure Access to Information Associated With a Value Item
US20090034741 *31 Jul 20075 Feb 2009Sabev Anton IAsymmetric key wrapping using a symmetric cipher
US20090138701 *26 Nov 200828 May 2009Nagravision S.A.Method for recording and restoring a ciphered content by a processing unit
US20110075537 *25 Sep 200931 Mar 2011General Electric CompanyHolographic disc with improved features and method for the same
US20120011364 *19 Sep 201112 Jan 2012Rubin Aviel DMethod for secure remote backup
US20120096566 *21 Dec 201119 Apr 2012Microsoft CorporationFirst computer process and second computer process proxy-executing code on behalf of first process
USRE3800717 Aug 200025 Feb 2003Sony CorporationControlled-access broadcast signal receiving system
USRE38375 *27 Apr 200030 Dec 2003International Business Machines CorporationMethod and system for the secured distribution of multimedia titles
USRE415462 May 200717 Aug 2010Klimenty VainsteinMethod and system for managing security tiers
USRE4165713 Jun 20027 Sep 2010Makoto SaitoData management system
USRE4170920 May 200814 Sep 2010Sony CorporationControlled-access broadcast signal receiving system
USRE421631 Jun 200622 Feb 2011Intarsia Software LlcData management system
USRE435991 Feb 200721 Aug 2012Intarsia Software LlcData management system
USRE439069 Dec 20081 Jan 2013Guardian Data Storage LlcMethod and apparatus for securing digital assets
USRE4424512 Mar 200428 May 2013Ati Technologies UlcMethod and apparatus for detecting protection of audio and video signals
CN1912885B13 Feb 199622 Dec 2010英特特拉斯特技术公司Systems and methods for secure transaction management and electronic rights protection
CN100389563C20 Dec 200021 May 2008索尼公司Data processing device, system and method
CN100452072C13 Feb 199614 Jan 2009英特特拉斯特技术公司Systems and methods for secure transaction management and electronic rights protection
CN100591008C17 May 200417 Feb 2010株式会社日立制作所Contents transmitting apparatus, contents receiving apparatus and contents transmitting method
DE19625635C1 *26 Jun 19964 Dec 1997Fraunhofer Ges ForschungVerschlüsselung und Entschlüsselung von Multimediadaten
DE19744293C1 *7 Oct 19971 Jul 1999Fraunhofer Ges ForschungMethod of encoding and decoding of multimedia data with definition and multimedia data blocks
EP0702286A2 *10 Aug 199520 Mar 1996Fujitsu LimitedData management module, data reproduction management device and data reproduction management system
EP0704785A2 *25 Sep 19953 Apr 1996Mitsubishi CorporationData copyright management system
EP0752663A1 *2 Jul 19968 Jan 1997Mitsubishi Denki Kabushiki KaishaCopyright control system
EP0766165A2 *10 Jul 19962 Apr 1997Fujitsu LimitedLicensee notification system
EP0773490A1 *5 Nov 199614 May 1997Fujitsu LimitedSecurity system for protecting information stored in storage media
EP0798892A2 *27 Feb 19971 Oct 1997International Business Machines CorporationCreation and distribution of digital documents
EP0800312A1 *4 Oct 19968 Oct 1997Matsushita Electric Industrial Co., Ltd.Data transmitter, data transmitting method, data receiver, information processor, and information recording medium
EP0817185A2 *27 Jun 19977 Jan 1998Kabushiki Kaisha ToshibaEnciphering method, deciphering method, recording and reproducing method, deciphering device, deciphering unit device, recording medium, recording-medium manufacturing method, and key control method
EP0840194A2 *2 Jun 19976 May 1998Matsushita Electric Industrial Co., Ltd.System and method for controlling the use of a package of distributed application software
EP0848314A1 *11 Aug 199717 Jun 1998Ncr International Inc.Document security system and method
EP0861461A2 *13 Feb 19962 Sep 1998Electronic Publishing Resources, Inc.Systems and methods for secure transaction management and electronic rights protection
EP0878753A2 *28 Apr 199818 Nov 1998Mitsubishi CorporationData content dealing system
EP1059810A2 *19 May 200013 Dec 2000ATI International SRLMethod and apparatus for processing video signals having associated access restriction data
EP1061430A1 *28 Apr 200020 Dec 2000Pulse Entertainment, Inc.Software authorization system and method
EP1148407A2 *2 Jun 199724 Oct 2001Matsushita Electric Industrial Co., Ltd.System and method for restricting the use of a package of distributed application software
EP1431864A2 *13 Feb 199623 Jun 2004Electronic Publishing Resources, Inc.Systems and methods for secure transaction management and electronic rights protection
EP1469658A2 *6 Apr 200420 Oct 2004Orga Kartensysteme GmbHMethod for protecting data from unauthorised use on a mobile terminal
EP2110732A2 *13 Feb 199621 Oct 2009Intertrust Technologies CorporationSystems and methods for secure transaction management and electronic rights protection
WO1996024092A2 *1 Feb 19968 Aug 1996Greg BensonA method and system for managing a data object so as to comply with predetermined conditions for usage
WO1996027155A2 *13 Feb 19966 Sep 1996Electronic Publishing ResourceSystems and methods for secure transaction management and electronic rights protection
WO1997007448A2 *8 Aug 199627 Feb 1997Cornel SirbuConditional access method and device
WO1997024675A1 *27 Dec 199610 Jul 1997Lotus Dev CorpMethod and apparatus for controlling access to encrypted data files in a computer system
WO1997024699A1 *29 Dec 199510 Jul 1997S E Axis LimitedAuthentication of articles
WO1997036237A1 *28 Mar 19972 Oct 1997Advanced Micro Devices IncMethod and apparatus for upgrading the software lock of a microprocessor
WO1997036238A1 *28 Mar 19972 Oct 1997Advanced Micro Devices IncMethod and apparatus for software access to a microprocessor serial number
WO1997036239A1 *28 Mar 19972 Oct 1997Advanced Micro Devices IncMethod and apparatus for encrypting and decrypting microprocessor serial numbers
WO1997044736A1 *15 May 199727 Nov 1997Apple ComputerMethod and apparatus for two-level copy protection
WO1997048034A1 *14 Jun 199718 Dec 1997Erland WittkoetterApparatus and method for the protected transmission and representation of electronically published documents
WO1998003904A1 *17 Jul 199729 Jan 1998Sigurd SigbjoernsenProtection of database contents against use without permit
WO1998016034A1 *8 Oct 199716 Apr 1998Protocall Technologies IncSecured electronic information delivery system having a three-tier structure
WO1998024037A2 *17 Nov 19974 Jun 1998Hyperlock Technologies IncMethod for securely triggering the playing of crippled local media through the web
WO1998050841A1 *29 Apr 199812 Nov 1998Motorola LtdSystem, method and apparatus for the prevention of unauthorised data download
WO1999000958A1 *26 Jun 19977 Jan 1999British TelecommData communications
WO1999008411A2 *6 Aug 199818 Feb 1999Jonathan StiebelNew operation for key insertion with folding
WO1999013611A1 *4 Sep 199818 Mar 1999Currie Bruce JohnData dissemination system for computer networks
WO1999014652A1 *11 Sep 199825 Mar 1999Microsoft CorpEncrypting file system and method
WO1999035582A1 *19 Jun 199815 Jul 1999Chew Wah LuiA computer software activation system and a method of authenticating computer software
WO1999060458A2 *14 May 199925 Nov 1999Deskgate Technologies IncRegulating access to digital content
WO2000044119A1 *24 Jan 200027 Jul 2000Henry T FungUniversal mobile id system and method for digital rights management
WO2000072160A1 *25 May 200030 Nov 2000Freeflyr LlcDisk dispensing and retrieval system with automated quality control and internet usage feedback
WO2001001222A1 *19 Jun 20004 Jan 2001Centura SoftwareSecuring databases using mutual consent access
WO2001030041A2 *17 Oct 200026 Apr 2001George J TomkoSystem and method for secure data handling over a network
WO2001031527A1 *26 Oct 19993 May 2001Robert E FraserMethod for dynamically wrapping files for downloading
WO2001078285A1 *2 Apr 200118 Oct 2001Mediadna IncSystem and method for controlling and enforcing access rights to encrypted media
WO2001088817A1 *15 May 200122 Nov 2001Centennial Technologies IncFee management for programming of electronic devices
WO2002001271A1 *22 Jun 20013 Jan 2002Koninkl Philips Electronics NvMultiple encryption of a single document providing multiple level access privileges
Classifications
U.S. Classification705/54, 380/277, 380/29, 380/43, 705/51, 380/281
International ClassificationG06F9/445, G06F21/00, G06F12/14, G06F13/00, G09C1/00, G06F21/20, H04L9/08, G06F21/24, G06F21/22, G06F1/00
Cooperative ClassificationG06F2221/2107, H04L9/0822, H04L9/0637, H04L2209/605, H04L2209/56, H04L9/0894, G06F21/10
European ClassificationH04L9/08, G06F21/10
Legal Events
DateCodeEventDescription
14 Sep 2005FPAYFee payment
Year of fee payment: 12
20 Sep 2001FPAYFee payment
Year of fee payment: 8
2 Sep 1997FPAYFee payment
Year of fee payment: 4
12 Apr 1993ASAssignment
Owner name: IBM CORPORATION, NEW YORK
Free format text: ASSIGNMENT OF ASSIGNORS INTEREST.;ASSIGNOR:PRYMAK, NANCY;REEL/FRAME:006473/0816
Effective date: 19921230
Free format text: ASSIGNMENT OF ASSIGNORS INTEREST.;ASSIGNORS:JOHNSON, DONALD B.;WILKINS, JOHN D.;BRACCO, ALPHONSE M.;AND OTHERS;REEL/FRAME:006473/0798;SIGNING DATES FROM 19921001 TO 19921014
14 Jan 1993ASAssignment
Owner name: IBM CORPORATION, NEW YORK
Free format text: ASSIGNMENT OF ASSIGNORS INTEREST.;ASSIGNOR:HALTER, BERNARD J.;REEL/FRAME:006473/0792
Effective date: 19921001